In this article5 sections
Keystone confirmed on October 24, 2026, that its website had been breached, four days after detecting an intrusion on October 20 that exposed customer shipping addresses and order histories, Cointribune reported. The hardware wallet maker said private keys were not directly compromised, but the leaked purchase and delivery records are now available to targeted hacking networks.
Keystone is one of six crypto security firms to report an incident in 2026, a sequence Cointribune described as an abnormal concentration of failures that has eroded confidence in hardware wallets.
Also read: Revolut Attackers Threaten Daily Data Leaks After Customer IDs Exposed
Key facts
- Keystone detected a website intrusion on October 20, 2026, and confirmed it publicly on October 24; customer addresses and order histories were exposed.
- A seed phrase generation flaw at Coldcard, revealed in July 2026, let attackers reconstruct private keys and take about 116 million dollars in bitcoin.
- Trezor reported data leaks at providers ShipMonk and Brevo on August 13 and September 10, exposing more than 427,000 emails and records.
- SafePal disclosed an order tracking flaw on August 16 affecting 39,798 customers, and BitBox reported email theft via subcontractor Brevo on September 24.
- Ledger confirmed on October 10 that malicious hardware components had been inserted into devices sold by third-party resellers, capturing recovery phrases when powered on.
Where the failures sit
The incidents fall into two groups. Database thefts at Keystone, Trezor and BitBox expose users to targeted phishing and social engineering rather than direct key theft. The Coldcard case was different: the flaw sat in key generation itself, making it the most costly of the breaches Cointribune catalogued.
Ledger’s disclosure addressed the physical supply chain instead. According to Cointribune, the implanted component recorded the security phrase as soon as an affected device was switched on, illustrating how distribution through resellers became a weak point.
Also read: Coldcard probes phishing post on its X account after July exploit
Why the incidents clustered
Cointribune pointed to three factors behind the concentration of events between August and October 2026. Summer restocking for the third quarter exposed logistics and resellers to physical intrusion. Wallet makers’ reliance on marketing and delivery subcontractors turned a single breach at Brevo into leaks at more than one brand. And publicity around the Coldcard flaw prompted security researchers to audit the wider market, producing a wave of disclosures and patches in September and October.
The practical effect is that manufacturers’ exposure now sits as much in email vendors and shipping partners as in their own firmware.
Why it matters
Hardware wallets were marketed on the principle that keeping keys offline removes them from remote attack. The 2026 incidents show that key generation, supply chains and customer databases are all part of the same risk surface, even when the device itself is never reached. The stolen order data in particular matters because it lets criminals link a person to a purchase, which is the input for convincing impersonation. The larger count of affected brands also means users now have to weigh several vendors’ records rather than trust a single device.
What to watch
Keystone has not published a full count of affected customers, and how the six firms handle notification, device replacement and reseller audits will shape trust in self-custody going into the fourth quarter. Cointribune’s guidance for holders is to buy only through official brand channels, reset any device that looks suspicious, add an extension passphrase and use anonymized shipping addresses.
Reported by cointribune.com.
Source: Cointribune