keystone

Keystone’s official website was breached
The leaked data was shipping information

Unauthorized access was discovered on 10/20
On 10/23, it was confirmed that a third party had obtained names, contact details, addresses, ordered products, and prices
Payment card and bank details, recovery phrases, private keys, and wallet passwords were not exposed
The company has blocked the access, fixed the issue, and sent emails

A shipping data leak doesn’t mean your hardware wallet is compromised
But social engineering scams and fake refund or device replacement offers may follow
If someone calls claiming they can resend your device,
hang up first, then verify through official channels
$BTC
#Keystone #安全 #硬件钱包 #钓鱼 #慢雾

There have been more and more security incidents lately!

Keystone, the hardware wallet company, has officially announced a data breach:

In brief, a third party obtained customers’ shipping information, including their names, contact details, delivery addresses, and order details (including product names and prices). No bank card or bank account information, recovery phrases, private keys, or wallet passwords were involved.

Keystone warned that scammers may impersonate the company by phone, text message, email, or postal mail, and try to defraud people by offering refunds, device replacements, or help with order or address issues.

If you use this wallet, please be extra careful. Don’t casually reply to or click on unexpected text messages, emails, or similar communications—they could be phishing attempts.

#Keystone #硬件钱包 #钱包安全 #Anti-Phishing

The hardware wallet itself didn’t lose any coins. But the people who bought one had their addresses exposed first—and that’s the most unsettling part of the Keystone story.

Here’s what happened. Hardware wallet maker Keystone issued an apology on October 25, saying it discovered unauthorized access to its website on October 20. After checking API activity with Shopify on October 23, it confirmed that a third party had obtained customers’ shipping information. The exposed data included names, contact details, delivery addresses, and order details—what customers bought and how much they paid. What was not exposed: bank card or bank account information, seed phrases, private keys, or wallet passwords. Keystone says it has closed off the access point, fixed the vulnerability, and is investigating. It is also emailing affected customers, and a detailed investigation report will follow.

Why does this hit so close to home for everyday users? Scammers don’t need to break into your wallet—they already have your real order information. For a while, you might get a call, text, email, or even a letter from someone claiming to be Keystone, offering a refund, a replacement device, or help changing your shipping address. They may even accurately name what you bought and where it was shipped. That can make the message seem genuine and easily catch you off guard. There’s another concern, too: your home address is now linked to the fact that you bought a hardware wallet. Mishaboar from the Dogecoin community has also warned that similar incidents have happened before with Trezor and Ledger, and the next thing to watch out for is a wave of targeted phishing attempts.

Three things you can do right now. First, assume that anyone who contacts you out of the blue about a refund, device replacement, or address change is not official. Don’t click their links or share any information over the phone. Open the official website yourself or contact support through official channels to verify. Second, never share your seed phrase or private key with anyone, and never enter your seed phrase on a device you didn’t use to place the order. The official company will never ask for these. Third, if you receive a suspicious message that knows your order details, take a screenshot and keep it. Don’t reply or click anything. Also avoid posting information about your holdings or deliveries on social media. Your address has already been exposed—don’t volunteer any more information.

Have you recently received a sales or customer support message that accurately named something you bought?

#Keystone #硬件钱包 #钱包安全 #ScamPrevention

—— web3 Crypto Noob Kai

Disclaimer: This is a personal account and does not constitute investment advice. The content is for learning and discussion only. Cryptocurrency investments involve risks; proceed with caution.

Keystone, the hardware wallet maker, had a problem with its official website: it wasn’t private keys that were stolen, but customers’ shipping information.

On the evening of October 24 (around the early hours of the 25th in UTC+8), Keystone posted a public apology on X. The company said it discovered unauthorized access to its official website on October 20. After checking its Shopify integration, it confirmed on October 23 that a third party had obtained customers’ shipping information: names, contact details, shipping addresses, and what they had purchased and how much they had paid. The company also stressed that no bank card or banking information, seed phrases, private keys, or wallet passwords were exposed. It has closed off the access point, patched the vulnerability, and begun emailing affected users.

The real concern is what happens next. If scammers have someone’s real name and home address, they can pose as Keystone and call or text them with claims like “We’ll refund you,” “We’ll send you a replacement,” or “We’ll help change your address”—and seem far more convincing than ordinary phishing attempts. Keystone reminds users that its official team will never ask for a seed phrase or private key. Don’t click unfamiliar links; type keyst.one into your browser yourself. And never import a seed phrase into a device you didn’t order.

A cold wallet keeps keys offline, protecting against on-chain theft. But if an online store leaks customers’ names and addresses, the risk shifts to in-person social engineering. If you’ve bought a Keystone wallet and receive a call from “customer support” in the coming days, it’s safer to treat it as a scam.

#安全 #硬件钱包 #Keystone This is not investment advice.

Keystone revealed early this morning: Its website was hacked on October 20, exposing customers’ names, phone numbers, shipping addresses, what they bought, and how much they spent. The only things not exposed were recovery phrases and private keys—the wallets are offline, but the people who buy them are identifiable.

Here come the different reactions: Those who ordered directly from the website are checking their inboxes every day for phishing emails; those who bought through third-party resellers are quietly relieved they didn’t use their real names; and another group is already wondering how they’d handle a scammer showing up at their door to “deliver a new device.”

The most painful part is that this isn’t the first time: Ledger, Trezor, SafePal, and Coldcard have all had security issues this year. The companies selling safes keep taking turns losing their customer lists.

So here’s the question: When you buy a hardware wallet, are you protecting your crypto or yourself? If your address has been exposed, is that safe really safe anymore? Sound off in the comments: Raise your hand if you bought from the official website; raise your hand if you used a reseller.
$BTC $ETH $SOL
#Keystone #硬件钱包 #coldwallet

A hardware wallet protects your private keys; the official website protects your delivery and contact information.

According to reports, Keystone’s official website was accessed without authorization on October 20, exposing users’ names, contact information, delivery addresses, and order details. Payment cards, recovery phrases, private keys, and wallet passwords were not affected. The company says it has fixed the issue and notified users, and warns them to watch out for follow-up scam messages.

How to interpret this: on-chain assets and off-chain identity carry two separate sets of risks. Even if your seed phrase is still stored on a cold device, leaked order and address details can become an entry point for phishing—fake customer support, fake refunds, or fake firmware links. If you receive a direct message claiming to be “official,” verify it through the channels on the official website first. Don’t click unfamiliar links, and never follow requests to “verify your recovery phrase.”

#Keystone #硬件钱包 #安全 #PhishingPrevention

I came across Keystone’s official apology: Its website was accessed without authorization on October 20. On the 23rd, after checking with Shopify about the API, the company confirmed that a third party had obtained customer information related to deliveries.

The leaked data included names, contact details, shipping addresses, and what customers bought and how much they paid. The company says no payment card or bank information, recovery phrases, private keys, or wallet passwords were obtained. The vulnerability has been contained and patched, and affected users are being notified by email.

The bigger concern is follow-up scams: someone could impersonate customer support and use a refund, exchange, or address change as a pretext to get your recovery phrase. Type keyst.one into your browser yourself to visit the official website. Don’t click unfamiliar links, and never enter your recovery phrase on a device you didn’t use to place your order.

The hardware wallet’s air gap is still intact; this incident involved customer data on the e-commerce website.

#Keystone #硬件钱包 #Security

【Market Update】Keystone, a hardware wallet provider, was hacked: customer addresses and order details were exposed. The company says payment information, seed phrases, and private keys were not compromised. The vulnerability has been patched, and access has been cut off.
But combining addresses with order details lets phishers and fake customer support agents target people precisely—that’s the real concern. Don’t click links claiming to be “official” before checking the domain.
Are you still keeping all your large assets in one wallet, or have you moved them to a cold wallet and set up multiple backups?
$BTC $ETH $USDT
#Keystone #钱包安全 #Cybersecurity
(Source: The Defiant)
⚠️Risk Warning: The information above is shared for market awareness only and does not constitute investment advice. Investing involves risks; please exercise caution.

“The private key recovery phrase wasn’t leaked, so the impact is limited”—what annoys me most about the Keystone data breach is seeing countless crypto news accounts repeat that line verbatim.

What was leaked? Names, contact details, shipping addresses, order details—even what you bought and how much you spent. The company says it discovered on October 20 that someone had obtained data through Shopify, but didn’t confirm it until October 23.

Put another way: a list of “whose home has a hardware wallet, and roughly how much they spent on it” is now in someone else’s hands.

And that’s “limited impact”? Your wallet may be cold, but your home isn’t.

What’s more, scammers moved faster than the announcement. On October 23, a user posted that they’d received a call from a number spoofing Montreal police. The caller opened with, “We’ve arrested 200 people,” and tried to gradually fish for information. The user immediately suspected the Keystone customer database had been leaked.

Ledger has had a leak, Trezor has had a similar incident, and now it’s Keystone’s turn. Hardware wallets sell peace of mind, but the least secure link turned out to be the online store’s backend.

If you’ve bought one, don’t cut corners on these things: treat any email, call, or text about a “replacement device,” “security upgrade,” or “police investigation” as a scam; never give your recovery phrase to anyone; and for future orders, use a pickup point instead of giving your home address if you can.

No matter how secure things are on-chain, it won’t help if someone knows where you live.

#Keystone #hardwarewallet

　　User data from hardware wallets can also be leaked—and now it’s Keystone’s turn. Its official website was accessed without authorization, and users’ names and shipping addresses were stolen. Private keys were not compromised, but the risk to users’ physical safety has already been created. Many people buy hardware wallets to protect themselves from hackers, only to find they can’t even keep their home addresses safe. That’s more chilling than losing coins.

　　Electrum also disclosed a high-severity vulnerability and urged users to upgrade to version 4.8.3. These two security incidents happening at once show that pressure on wallet security is mounting. Attackers aren’t necessarily always targeting on-chain assets; offline information is valuable too. For ordinary users, updating software and checking whether their shipping information needs to be changed is more urgent than watching the K-line.

　　Meanwhile, Arthur Hayes transferred another 14 million ENA to Cumberland, making frequent moves. Strategy and Strive raised funds through preferred stock to buy 135,979 bitcoins, accounting for more than 0.5% of the maximum supply. Institutions are steadily accumulating through financing structures, in contrast with retail investors’ hesitation as $BTC fell 1.44%. $BTC is currently priced at 80,791.07, with a low of 79,220.74 for the period—a fairly wide swing.

　　A certain whale holds $397 million worth of BTC and ETH long positions, and added $9.21 million in margin in the early hours to lower the ETH liquidation price. Adding margin is a defensive move, showing that leveraged positions are under pressure. Market breadth has improved, with the share of S&P 500 constituents above their 50-day moving averages rising to 61%, but leverage risks in crypto have not gone away. Security vulnerabilities, institutional financing to buy coins, and a whale taking defensive action all point to the same issue: participants’ sources of risk are becoming increasingly diverse, and focusing only on prices means missing key variables.

$ETH $ENA #Keystone #Electrum #HardwareWallet

2025 Crypto Cold Wallet Mainstream Product Comprehensive Ranking (Security + Usability Dimension) — Nifulei

▍ First Tier | Flagship Security

🥇 Ledger Flex (Nifulei's personal choice)
Overall strength is top-notch, ecosystem, compatibility, and user experience still belong to the industry's highest level.

🥈 Trezor Safe 5 (Nifulei's personal choice)
Open-source security benchmark, extremely high transparency and community trust, still a core choice for the geek crowd.

🥉 NGRAVE ZERO
Focuses on ultimate security, high-level security certification + strong isolation architecture, leaning towards a 'physical-level security' solution.

▍ Balanced Usability Tier Highlights

⭐ OneKey Pro performs exceptionally well (Nifulei's personal choice🔥)

As a representative of domestic open-source products, OneKey Pro adopts a fully open-source architecture and is equipped with EAL4+ ×4 security certification, balancing security chip performance and overall usability quite well.

Overall, it's very suitable for users pursuing: "open-source transparency + multi-chain support + local experience + practicality."

▍ Overall Market Landscape
In 2025, the cold wallet market is still dominated by international brands like Ledger and Trezor, showing clear advantages in ecosystem maturity and long-term market validation.

However, domestic open-source products like OneKey are also rising rapidly, especially among the Chinese user base and open-source enthusiasts.

The core of cold wallets will always be “security first,” but in actual long-term use, usability, ecosystem compatibility, and cost-effectiveness are also very important.
(Data as of May 2025)

Which cold wallet do you think has the most potential? Feel free to discuss 👇

For more about crypto cold wallets, check out Nifulei's independent site:

hardware-wallet.nifulei.com

#coldwallet #ledger #onekey #trezor #Keystone