On October 25, Hong Kong-based self-custody hardware wallet brand Keystone, known for its full isolation and QR code signing, disclosed that its official website was unauthorizedly accessed on October 20, exposing customer names, contact information, shipping addresses, and order details (including purchased products and prices). The company confirmed on October 23, after verifying API activity with Shopify, that a third party obtained customer shipping information. Keystone emphasized that payment card and bank information, mnemonic phrases, private keys, and wallet passwords were not leaked. The company has blocked access, patched vulnerabilities, initiated an investigation, and notified affected customers via email, warning that scammers may impersonate Keystone to deceive customers under the pretext of refunds or device exchanges. Customers are advised not to click on suspicious links and not to disclose mnemonic phrases and private keys, with plans to release a detailed report within a few days. Other companies in the industry, such as Trezor (which experienced a leak from logistics provider ShipMonk in August) and Ledger (which had a security incident this month involving modified devices stealing mnemonic phrases), have also faced security issues.
All Comments