The incident follows the problems faced by Ledger and Trezor in the past few months.
ByJordan Lyanchev
Keystone Wallet has become the latest big hardware wallet provider to report a security issue after unauthorized access to its website exposed customer information.
The breach came during a particularly uncomfortable period for the broader hardware wallet industry, with the two giants, Ledger and Trezor, dealing with separate security incidents since the summer.
Keystone Customer Data Exposed
The company disclosed over the weekend that it had detected unauthorized access to its official website on October 20. After reviewing API activity on Shopify, the team confirmed several days later that the unauthorized third party had obtained customer shipping information.
The exposed data includes names, contact details, shipping addresses, and order information such as the products purchased and at what prices. However, Keystone reassured that payment card, bank information, wallet passwords, recovery phrases, and private keys were not compromised.
The hardware wallet manufacturer has since blocked the unauthorized access, patched the vulnerability, launched an investigation, and begun contacting affected clients. It also promised a more detailed report in the following days.
Nevertheless, the leaked information creates another security problem. Knowing that a particular individual purchased a hardware wallet, and having their name, contact information, and physical address, could allow criminals to launch highly targeted phishing or social-engineering attacks.
Consequently, Keystone warned that scammers could impersonate the company through phone calls, texts, emails, or even physical mail while offering refunds, replacement devices, or supposed fixes.
