Executive Summary
- •Hardware wallet provider Keystone confirmed that unauthorized website access linked to Shopify API activity exposed customer names, phone numbers, shipping addresses, and order records.
- •The breach was detected on October 20 and confirmed on October 23, following earlier industry incidents at Trezor affecting 80,689 customers and SafePal affecting approximately 39,798 customers.
- •While payment details, private keys, and recovery phrases were not compromised, Keystone warned that attackers could use the exposed shipping data for targeted phishing scams.
Keystone blocked the unauthorized Shopify API access and patched the vulnerability, while warning affected customers to watch for targeted phishing attempts and promising a full incident report in the coming days.
Key Developments & Data
Self-custody your Bitcoin & crypto with Trezor
Zubiqo Strategic Assessment
Primary Impact
Keystone hardware wallet customers whose names, phone numbers, physical shipping addresses, and purchase histories were exposed to a third party.
Strategic Shift
Attackers continue targeting third-party e-commerce and logistics APIs rather than air-gapped wallet hardware directly, using order databases to enable targeted social engineering.
The Ripple Effect
Exposed customers face elevated risks of targeted phishing campaigns impersonating support staff regarding deliveries, refunds, or replacement devices, while Keystone prepares a detailed incident report in the coming days.
This intelligence assessment is generated by Zubiqo's AI for informational purposes only.
Community Sentiment
The daily signal, delivered every weekday.
A concise weekday briefing on AI, technology and business. Zero PR fluff.
Subscription completes on Substack • Free • 1-click unsubscribe anytime
Intelligence Quality Rating
Grade this brief: Slide & release to submit rating, or tap a preset.
