Do Son 
Cryptocurrency hardware wallet manufacturer Keystone recently disclosed an unauthorized intrusion into its web platform. Specifically, security engineers detected anomalous activity targeting internal Shopify application programming interfaces. Consequently, attackers exfiltrated sensitive customer records containing names, contact details, shipping addresses, and purchase histories. In an official incident disclosure on Keystone customer data exposure, the company confirmed the perimeter breach.
Impersonation Scams Target Hardware Wallet Owners
Even before the formal advisory, customers reported sophisticated social engineering attempts. For example, fraudsters contacted users while impersonating law enforcement officers from the Montreal police department. The callers claimed to have dismantled an active fraud syndicate. Furthermore, the impostors verified legitimate transaction details to extract additional personal information. Fortunately, vigilant cryptocurrency investors recognized the deceit and raised public warnings on social media platforms.
Physical Security Risks and Wrench Attacks
Importantly, Keystone emphasized that user cryptographic keys and private seed phrases remain entirely uncompromised. Therefore, customer digital assets residing on hardware devices do not face immediate on-chain theft. However, leaked physical addresses introduce dangerous physical security risks known across the industry as wrench attacks. In these terrifying encounters, criminal groups employ physical extortion or home invasions to force digital asset transfers. Because adversaries now possess residential addresses, hardware owners face elevated real-world exposure.
Unclear Temporal Scope of the Intrusion
Unfortunately, Keystone failed to disclose the precise historical timeframe governing the compromised records. Consequently, the absence of clear operational boundaries suggests that historical customer archives were exposed indiscriminately.
Broken Privacy Pledges Regarding Data Retention
The incident also reveals glaring contradictions in corporate data retention practices. Specifically, Keystone publicly pledged that customer shipping data undergoes automated deletion within 180 days. In its revised July 2026 privacy policy, the vendor confirmed this exact data scrubbing protocol.
Nevertheless, affected customers who filed orders back in 2024 received fraudulent calls. This evidence clearly proves that the company retained sensitive transaction records long after the promised retention deadline. Ultimately, excessive data retention unnecessarily magnifies physical threats for privacy-conscious cryptocurrency holders.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
