- Hardware wallet provider Keystone Wallet confirmed that an unauthorized party has accessed its website’s customer database.
- It warned that affected users may be targeted by phishing attempts.
Keystone Wallet, an open-source, air-gapped cold storage crypto hardware wallet provider (formerly known as Cobo Vault), has confirmed a security incident involving unauthorized access to its website’s customer database. The breach occurred on October 20, over the weekend.
The Keystone Wallet Incident
According to Keystone Wallet, a third-party entity illegally obtained customer shipping logs. The company detected the breach through API activity monitoring with Shopify, the cloud-based commerce platform powering its online store.
The unauthorized party accessed sensitive user information, including names, contact details, shipping addresses, and product purchase details. However, Keystone Wallet has assured customers that critical security elements—such as payment card or bank details, recovery phrases, private keys, and wallet passwords—were not compromised.
The company has immediately blocked the hacker’s access, patched the exploited vulnerability, and launched a thorough investigation. Affected customers have been notified and provided with guidance on how to protect themselves.
Phishing Attempts on Affected Customers
In light of the data breach, Keystone Wallet has warned that affected customers may be targeted by phishing attempts. Cybercriminals may leverage the leaked information to impersonate company representatives and contact users.
Scammers might offer refunds, replacement devices, or fixes for alleged order or delivery issues, requesting sensitive data like bank account details, financial information, passwords, or private keys to “resolve” the problem.
Keystone Wallet emphasized that these communications are entirely fraudulent. The company stated that it does not require such sensitive information to assist customers.
To protect themselves, users are advised never to share their recovery phrases or private keys. Furthermore, customers should avoid entering their recovery phrase on any device they did not personally order.
Additionally, Keystone Wallet recommended that users avoid clicking links when navigating to its website. Instead, they should manually type “keyst.one” to ensure they are not redirected to malicious platforms.
Keystone Wallet has issued a formal apology to all affected users for failing to secure customer shipping information. The company encourages users to contact them directly through official channels, specifically at “support@keyst.one”, if they suspect any suspicious activity or feel uneasy about potential interactions.
As the investigation remains ongoing, Keystone Wallet has not yet released a detailed report regarding the exact number of affected users, the identity of the attacker, or the duration of the unauthorized access to its e-commerce system.