A hardware wallet maker had a security incident—and this time, it wasn’t your crypto that was exposed, but your shipping address 👀
Keystone came clean on October 24:
On October 20, they discovered unauthorized access to their website.
After checking API logs with Shopify, they confirmed on October 23 that a third party had obtained customers’ shipping information.
Only then did they issue a public apology.
What was leaked:
Names, contact details, and shipping addresses.
Order details, too—including what you bought and how much you paid.
What wasn’t leaked:
No bank or payment card information.
No seed phrases, private keys, or wallet passwords.
The wallets themselves weren’t compromised, and your crypto is still safe on the blockchain.
But don’t let that put you at ease.
The real trouble may be yet to come.
Scammers now have the complete picture: who you are, where you live, and which wallet you bought.
Next, they may call, text, or email you while pretending to be Keystone.
I can already imagine what they’ll say:
Refunds, replacement devices, or a request to correct your order address.
One click, and your seed phrase could be at risk.
Keystone also made this crystal clear:
They will never ask for your seed phrase or private key.
Never enter your seed phrase into a device you didn’t order.
Don’t click links from unknown sources.
This reminds me of what happened with Ledger back then.
The crypto wasn’t stolen, but people were targeted with highly personalized phishing scams.
Hardware wallets protect your private keys from connecting to the internet.
They can’t protect the real-world identity stored in a company’s database.
So if you’ve bought a Keystone wallet,
treat any recent messages claiming to be from the company about refunds or replacements as scams by default—then verify by going to the official website yourself.
Have you received phishing messages from someone pretending to be an official representative?
Tell us in the comments how you spotted them.
$BTC $ETH
#硬件钱包 #Cybersecurity
Not investment advice. DYOR. Trading involves risk.
Keystone came clean on October 24:
On October 20, they discovered unauthorized access to their website.
After checking API logs with Shopify, they confirmed on October 23 that a third party had obtained customers’ shipping information.
Only then did they issue a public apology.
What was leaked:
Names, contact details, and shipping addresses.
Order details, too—including what you bought and how much you paid.
What wasn’t leaked:
No bank or payment card information.
No seed phrases, private keys, or wallet passwords.
The wallets themselves weren’t compromised, and your crypto is still safe on the blockchain.
But don’t let that put you at ease.
The real trouble may be yet to come.
Scammers now have the complete picture: who you are, where you live, and which wallet you bought.
Next, they may call, text, or email you while pretending to be Keystone.
I can already imagine what they’ll say:
Refunds, replacement devices, or a request to correct your order address.
One click, and your seed phrase could be at risk.
Keystone also made this crystal clear:
They will never ask for your seed phrase or private key.
Never enter your seed phrase into a device you didn’t order.
Don’t click links from unknown sources.
This reminds me of what happened with Ledger back then.
The crypto wasn’t stolen, but people were targeted with highly personalized phishing scams.
Hardware wallets protect your private keys from connecting to the internet.
They can’t protect the real-world identity stored in a company’s database.
So if you’ve bought a Keystone wallet,
treat any recent messages claiming to be from the company about refunds or replacements as scams by default—then verify by going to the official website yourself.
Have you received phishing messages from someone pretending to be an official representative?
Tell us in the comments how you spotted them.
$BTC $ETH
#硬件钱包 #Cybersecurity
Not investment advice. DYOR. Trading involves risk.