Another Major Hardware Wallet Provider Suffers Data Breach as Security Concerns Mount - CryptoPotato
Keystone Wallet has disclosed an unauthorized access to its official website on October 20, which exposed customer shipping information.
The company confirmed the unauthorized access after reviewing API activity on Shopify and stated that a third party obtained customer shipping information.
Exposed data includes names, contact details, shipping addresses, and order information such as products purchased and their prices.
Keystone reassured that payment card, bank information, wallet passwords, recovery phrases, and private keys were not compromised.
The company has since blocked the unauthorized access, patched the vulnerability, launched an investigation, and begun contacting affected clients.
It also promised a more detailed report in the following days.
Knowing that a particular individual purchased a hardware wallet, and having their name, contact information, and physical address, could allow criminals to launch highly targeted phishing or social-engineering attacks.
Rising security concerns for hardware wallet providers
The incident comes at a difficult time for the broader hardware wallet industry, with Ledger and Trezor facing separate security issues since the summer.
Ledger said earlier this month that bad actors had modified genuine devices by installing hidden hardware capable of reading the 24-word recovery phrase during initial setup and transmitting it through an LTE connection.
The company stressed that its Secure Element, operating system, and internal servers were not compromised, describing the scheme as a localized distribution-channel attack rather than a systemic breach of Ledger’s infrastructure.
Initial reports linked more than $86 million in suspected crypto thefts to the affected devices, although Ledger has not confirmed that figure.
Earlier this summer, Trezor encountered a breach at logistics provider ShipMonk that exposed customer names, emails, phone numbers, shipping addresses, and order information.
The company initially said over 13,000 US customers had their data exposed, but the number grew to more than 80,000 after more recent disclosures.
Related
