Hardware wallet manufacturer Keystone disclosed a customer data breach after unauthorized access to its official website via Shopify API activity was detected on October 20, marking the latest security incident to hit cold storage providers.
Key Takeaways
- Keystone confirmed exposed customer shipping data including names, addresses, contacts, and order prices, though private keys and recovery phrases remained secure.
- Ledger recently reported a localized supply-chain attack in Southeast Asia linked to over $86 million in unconfirmed thefts involving modified hardware with LTE transmitters.
- Trezor saw disclosures from a ShipMonk logistics breach expand from 13,000 to more than 80,000 impacted users.
Keystone Detects Shopify API Breach
Keystone revealed over the weekend that it detected unauthorized access to its website on October 20. Subsequent analysis of Shopify API activity confirmed several days later that an unauthorized third party had accessed customer shipping data. The exposed details include customer names, contact information, physical shipping addresses, and specific order records detailing purchased items and prices.
However, Keystone clarified that payment card details, bank information, wallet passwords, recovery phrases, and private keys were not compromised. The company has blocked the unauthorized access, patched the vulnerability, launched an investigation, and begun notifying affected users while preparing a comprehensive follow-up report. Keystone warned customers that bad actors could use the leaked logistics data to conduct targeted social engineering attacks via phone calls, text messages, emails, or physical mail presenting fraudulent offers for device replacements, refunds, or fixes.
Ledger and Trezor Face Parallel Security Incidents
The breach comes during a challenging period for cold storage providers. Earlier this month, Ledger disclosed that unauthorized bad actors modified genuine devices distributed through specific Southeast Asian resellers. The attackers installed hidden hardware designed to intercept the 24-word recovery phrase during initial device setup and broadcast it via an LTE connection. Ledger emphasized that its Secure Element, proprietary operating system, and internal servers remained uncompromised, characterizing the event as a localized supply-chain tamper. Unconfirmed initial reports connected more than $86 million in crypto thefts to the compromised units.
Simultaneously, Trezor experienced a data leak earlier this summer involving its third-party logistics provider, ShipMonk. That incident compromised customer names, emails, phone numbers, shipping addresses, and order records. While initial assessments indicated 13,000 U.S. customers were affected, subsequent disclosures expanded the total to more than 80,000 users.
Why It Matters
While hardware wallet private keys remain cryptographically secure, peripheral vulnerabilities in web store APIs and third-party logistics partners pose serious risks to self-custody users. Physical address leaks expose high-net-worth investors to targeted phishing, physical extortion, and social engineering attacks. As the broader industry navigates updated security disclosure policy overhauls, hardware wallet vendors must strengthen supply chain and data governance to maintain user trust.
