Keystone, a hardware wallet manufacturer, confirmed on 24/10 (X, 17:59 UTC) that a third party obtained its customers’ names, contact details, shipping addresses and order details through its official website. Seeds, private keys and banking data were not affected, according to the company.
A common misconception: “My funds are in cold storage, so this doesn’t concern me.” The timeline tells a different story. Keystone detected unauthorized access on 20/10 and confirmed the breach on 23/10 after reviewing API activity with Shopify. On that same day, 23/10 at 23:18 UTC, a customer had already reported a fake police call on X (with a spoofed number). The official announcement came about 19 hours later.
What’s still missing: the number of affected customers and the period covered. Keystone says it deletes addresses 180 days after an order, but customers who bought in 2024 are asking whether they’re affected. A detailed report was promised “in the coming days.”
My take: the target isn’t the device, it’s its owner. A name, an address and the fact that someone “bought a hardware wallet” make for a list of self-custody holders. Keystone warns that it will never offer refunds, replacement devices or “address corrections” by phone call, text, email or letter. Never enter your seed on a device you didn’t order, and type keyst.one manually.
If the report limits the breach to the past 180 days, this remains a targeted phishing risk. If it goes back further, the debate will turn to companies that keep addresses for too long.
As for the market, $BTC is holding at $80,592 (Kraken, 25/10 07:50 UTC) after more than $810M in liquidations over 24 hours on Saturday, according to CoinGlass (via Investing.com).
Question: did you have your hardware wallet delivered to your home or to another address?
#CryptoSecurity #SelfCustody
A common misconception: “My funds are in cold storage, so this doesn’t concern me.” The timeline tells a different story. Keystone detected unauthorized access on 20/10 and confirmed the breach on 23/10 after reviewing API activity with Shopify. On that same day, 23/10 at 23:18 UTC, a customer had already reported a fake police call on X (with a spoofed number). The official announcement came about 19 hours later.
What’s still missing: the number of affected customers and the period covered. Keystone says it deletes addresses 180 days after an order, but customers who bought in 2024 are asking whether they’re affected. A detailed report was promised “in the coming days.”
My take: the target isn’t the device, it’s its owner. A name, an address and the fact that someone “bought a hardware wallet” make for a list of self-custody holders. Keystone warns that it will never offer refunds, replacement devices or “address corrections” by phone call, text, email or letter. Never enter your seed on a device you didn’t order, and type keyst.one manually.
If the report limits the breach to the past 180 days, this remains a targeted phishing risk. If it goes back further, the debate will turn to companies that keep addresses for too long.
As for the market, $BTC is holding at $80,592 (Kraken, 25/10 07:50 UTC) after more than $810M in liquidations over 24 hours on Saturday, according to CoinGlass (via Investing.com).
Question: did you have your hardware wallet delivered to your home or to another address?
#CryptoSecurity #SelfCustody
