Keystone said it had blocked access, patched the vulnerability, opened an investigation and was notifying affected customers by email. It warned that scammers could exploit the incident by posing as Keystone representatives and offering refunds, replacement devices or assistance with orders and shipping addresses.
The company urged customers to avoid unexpected links and never disclose recovery phrases or private keys or enter recovery phrases into devices they had not ordered.
Keystone said it is conducting a thorough investigation and plans to release a detailed report in the coming days.
Keystone is best known for its fully air-gapped, QR-code-based transaction signing, which keeps private keys offline without relying on USB, Bluetooth or Wi-Fi.
The Hong Kong-based self-custody hardware wallet brand has expanded from its Bitcoin-focused origins into a multichain wallet supporting Ethereum, EVM assets, Solana, Polkadot, Cosmos and other networks through integrations with software wallets including MetaMask, Solflare, Keplr, Rabby and OKX Wallet.
Trezor and Ledger have also dealt with security incidents affecting their customers.
In August, Trezor disclosed a customer data breach at its logistics provider ShipMonk, while Ledger confirmed earlier this month that criminals had modified genuine hardware wallets to steal recovery phrases and resold them through Southeast Asian resellers.
Leave a Reply