-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0272 ============================================================ Advisory-ID: 0xCERT-2026-0272 Severity: Medium Published: 2026-10-24T17:59:04.000Z Updated: 2026-10-24T20:43:12.937Z Chains: n/a URL: https://www.0xcert.com/advisory/0xCERT-2026-0272 Title: Keystone hardware wallet web shop breach exposed customer names, contact details and shipping addresses Summary - ------- Keystone says an unauthorized party accessed its official website and obtained customers' names, contact details, shipping addresses and order details; recovery phrases, keys and payment data were not exposed. Expect targeted phishing posing as Keystone refunds or replacement devices. Details - ------- Summary Hardware wallet maker Keystone disclosed on 2026-10-24 that a third party gained unauthorized access to its official website and obtained customer shipping information. Keystone says it detected the access on October 20 and, after verifying API activity with its e-commerce provider Shopify, confirmed the data exposure on October 23. Keystone says no recovery phrases, private keys, wallet passwords or payment details were exposed. Affected - - Keystone customers whose order data was held by the official Keystone web shop (number of affected customers not disclosed) - - Exposed per Keystone: names, contact details, shipping addresses, and order details (items and prices) - - Not exposed per Keystone: payment card or bank details, recovery phrases, private keys, wallet passwords - - Fixed: Keystone says it blocked the access, fixed the vulnerability, opened an investigation, and is emailing affected customers. A detailed report has been announced but was not published at the time of this advisory. Impact No loss of funds has been reported. The leaked names, contact details, addresses and order details can be used for targeted phishing. Keystone warns that scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for orders or addresses. How the access was obtained has not been disclosed. Recommended actions - - Keystone customers: treat any unsolicited message or call referencing your order, a refund, a replacement device or an address "fix" as a scam. - - Never share your recovery phrase or private keys, and never enter your recovery phrase into a device you did not order yourself. Keystone states it will never ask for them. - - Do not click links in unexpected messages; type the official Keystone domain (keyst.one) yourself, and contact support@keyst.one if in doubt. - - Watch for physical mail or packages purporting to come from Keystone. Source & attribution This 0xCERT advisory summarises a disclosure by Keystone (https://x.com/KeystoneWallet/status/2114054080754770137), with additional timeline detail reported by Bitcoin.com News (https://news.bitcoin.com/security/keystone-wallet-data-breach-exposes-buyers-addresses-to-scammers/). Details may change; refer to the original source for the authoritative record. References - ---------- - - https://x.com/KeystoneWallet/status/2114054080754770137 - - https://news.bitcoin.com/security/keystone-wallet-data-breach-exposes-buyers-addresses-to-scammers/ Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmreDOoJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmeu7suNqowXjf4J/uFhJ3U0pxzufFlblocRkmNe AxZJQRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAp4wD+KtbakOTaMJV4akb6 CzoFJhY32QJOvaoAypap7ERPfdkBALkvnFnoX0MokGvzRyvLb/c5xwoy6yki YISIzb4VLcwH =7AVg -----END PGP SIGNATURE-----