SECURITY ALERT

Your seed is safe.

Your doorstep is not.

Keystone, the hardware wallet maker, said on Saturday that a third party took customer shipping information from its website. In a post on X at 17:59 UTC, it apologised and listed what was exposed: names, contact details, shipping addresses and order details, including items and prices.

It says payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed.

It has not said how many customers are affected, which orders the data covers, or how the attacker got in.

The timeline, in UTC

  • 20 Oct. Keystone detects unauthorized access to its official website, it says.
  • 23 Oct. After checking API activity with Shopify, the platform that runs its store, Keystone confirms that an outside party got hold of customers’ shipping data.
  • 23 Oct, 23:18. An X user says a caller using a spoofed Montreal police number tried to social-engineer them. The caller asked whether Keystone meant anything to them; the user says the details matched their 2024 Keystone order.
  • 24 Oct, 05:09. Keystone says it has “initiated an urgent investigation” and warns of suspicious calls, texts and emails.
  • 24 Oct, 17:59. Keystone discloses the breach. It says it has blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers.

In replies on Saturday, Keystone said a detailed report would follow “in the coming days.” The Defiant also reported the breach.

So if the seeds are safe, what is the leak worth?

Why an address is worth stealing

A list of hardware wallet buyers is a list of people who probably hold crypto.

With a name, a phone number and a home address, a scammer does not need to break the device. He needs the owner to hand over the words.

Keystone’s own warning says what to expect. Scammers may pose as the company by phone, text, email or post, offering refunds, replacement devices or “fixes” for an order or address. None of it, Keystone says, comes from them.

The replacement device is the old trick. In 2021, some Ledger customers whose details had leaked the year before reported receiving tampered devices in the post. Ledger’s warning about the CryptoBilis implant showed this month how a doctored signer can read a phrase off its own screen.

Keystone’s advice is blunt: “NEVER enter your recovery phrase into a device you didn’t order.”

What do you do when the scammer already knows your name?

Protect yourself

  • Expect contact. Treat any call, text, email or letter about your Keystone order as suspect, however much it knows about you.
  • Never share your recovery phrase or private keys. Keystone says it will never ask for them. Why the recovery phrase is the master key
  • Do not set up a device you did not order, and never type your phrase into one.
  • Do not click links in unexpected messages. Type keyst.one yourself; Keystone’s support address is [email protected].
  • If you have already typed your phrase anywhere, treat it as exposed and move funds to a new wallet with a new phrase.

This is the second hardware wallet warning in two weeks to arrive through a channel, not a chip. See the phishing link posted from COLDCARD’s own X account, and, on the software side, Electrum’s fix for a server trick that turned fee bumps into theft.

The device kept its secret. Will its owners keep theirs?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.