- Hardware wallet provider Keystone Wallet confirmed that an unauthorized party has accessed its website’s customer database.
- It warned that affected users may be targeted by phishing attempts.
Another hardware wallet provider falls victim to unauthorized access to its customer database. Over the weekend, Keystone Wallet (formerly Cobo Vault), an open-source, air-gapped cold storage crypto hardware wallet, confirmed that an attack on its website occurred on October 20.
The Keystone Wallet Incident
According to Keystone Wallet, a third-party entity has illegally obtained its customers’ shipping logs. The company verified the attack through its API activity with Shopify, a cloud-based commerce platform powering its online store.
The attacker accessed sensitive user information, including names, contact data, shipping addresses, and product details (containing specific items for each purchase). However, Keystone Wallet assured customers that their payment card or bank details, recovery phrases, private keys, and wallet passwords weren’t compromised.
Keystone Wallet stated that it has already blocked the hacker’s access to its website. It also patched the vulnerability and launched an investigation to assess the situation better. Additionally, the company has alerted affected customers for proper guidance.
Phishing Attempts on Affected Customers
In light of the situation, Keystone Wallet warned affected customers that they may be vulnerable to phishing attempts. Malicious actors may use the leaked information to contact them while posing as the company’s authorized representatives.
Scammers may offer users refunds, replacement devices, or fixes to a purported issue with their orders or delivery addresses. They will likely ask for bank account details, financial information, passwords, private keys, or other sensitive data to supposedly resolve the issue immediately.
Keystone Wallet clarified that none of those offers or communications are legitimate. It noted that it does not need such information.
The company advised customers to avoid sharing their recovery phrases or private keys. Moreover, they should refrain from entering their recovery phrase on a device they didn’t order.
Furthermore, Keystone Wallet emphasized that users should avoid clicking links when accessing its website. Instead, they should manually type “keyst.one” to ensure that they won’t be redirected to fraudulent platforms.
Keystone Wallet apologized to everyone affected by its failure to secure customer shipping information. Meanwhile, it urged users to contact them directly through official channels, particularly at the email address “support@keyst.one,” if anything feels off.
Since the investigation is ongoing, Keystone Wallet has yet to provide a detailed report on the matter, including the actual number of affected users, the attacker’s identity, and how long the unauthorized party maintained access to its e-commerce system.
