What exactly happened?
Hardware wallet maker Keystone has announced that an attacker gained access to data through a vulnerability on its website. According to the company, customers' shipping addresses and order details were leaked, report The Defiant and Cointelegraph.
A hardware wallet is a physical device that stores private keys to cryptocurrencies offline, out of reach of the internet. That is precisely why customers of these devices are often people holding larger amounts of crypto assets, which makes the leaked shipping addresses a sensitive list.
What, according to Keystone, was NOT leaked?
The company states that the breach did not touch the most sensitive information. According to The Defiant, the following were not exposed:
- payment information,
- recovery phrases (seed phrases),
- private keys.
A recovery phrase is a sequence of words that can restore access to a wallet. If it leaked, an attacker could steal funds directly. Keystone also claims it blocked the access and fixed the vulnerability, writes The Defiant.
Why is a leak of shipping addresses risky even without keys?
A security researcher, according to Cointelegraph, warned that even the shipping details alone can be misused. The combination of a name, an address, and the information that a given person owns a hardware wallet opens up two main risks:
- Targeted scams (phishing). Attackers can contact victims by name and with credible order details and try to get them to reveal sensitive information.
- Physical attacks. A list of people who likely hold crypto assets, together with their home addresses, increases the risk of robberies and extortion in the real world.
These are risks described by the source, not confirmed cases of misuse. Whether any misuse of the data has already occurred is not known from the available sources.
Should this data have been deleted long ago?
This is where the story gets complicated. According to The Block, Keystone states that in most cases it deletes customer data 180 days after an order. However, customers on the X platform claim, according to the same source, that their older data also appeared in the leak, and they question whether the company actually carried out the deletion.
The discrepancy has not yet been independently verified. We do not know how many customers are affected or exactly how old the leaked data is. This is a key open question of the whole case: if the company promised deletion and the data existed anyway, this is a failure of its own policies, not just the breach itself.
Broader context: data as a weak point even for "cold" solutions
Hardware wallets protect keys. But they do not protect the metadata created when purchasing the device: name, address, order history. This case shows that the attack surface at crypto firms does not end at the blockchain but begins already with ordinary web infrastructure and the handling of personal data.
What to watch for with this type of incident
This is not advice on what to do with your assets, but an overview of what is usually relevant to monitor with similar leaks:
- the manufacturer's official communication about the scope of the leak and who was affected,
- an increase in phishing attempts that pose as communication from the manufacturer or carrier,
- unexpected "verification" requests to enter your recovery phrase (a legitimate manufacturer never asks for it),
- any subsequent clarification of whether and for how long the data was actually retained.
What is confirmed so far and what is not
It is confirmed that Keystone admitted the breach and described what data was and was not affected. What remains unconfirmed is the actual scope, the number of affected customers, the age of the leaked data, and whether the data has already been misused. charliedesk will monitor whether Keystone publishes more precise figures.