Hardware wallet maker Keystone said an attacker who breached its website last week also stole a key used to verify device authenticity, which could let counterfeit wallets pass its checks. The company plans to destroy 18,835 devices in inventory that contain the compromised key and has suspended shipments of devices using it. It disclosed that 25,964 buyer records from 2024 to 2026 were stolen after a faulty data-erasure tool failed to delete them, and that 12,873 checkout records held by Shopify were also taken. Devices made and delivered before the Oct. 20 incident are considered safe, but the authenticity of later devices cannot be guaranteed. The breach follows other security issues at hardware wallet makers this year, including Ledger, Coinkite and Trezor.
Summary written by Upside AI from the original article. Read the source for full details.
Read the original on Cointelegraph ↗
Keywords
Open a keyword to see other news on the same topic.
Related tickers and likely impact
BTC/USDT
• NeutralBitcoin
Relevance: low
| Market | Crypto |
|---|---|
| Exchange | Binance |
| Sector | Layer 1 |
| Market cap | $1.6T |
| Close on 10/26/2026 | 80,150.56 |
| Change that session | 0.00% |
Impact is scored by AI from the headline and may be wrong. It is not investment advice.
Related news
- Keystone says website breach exposed hardware wallet buyers’ addresses
Hardware wallet maker Keystone said an unauthorized third party accessed customer shipping information through a website breach, including names, contact details, shipping addresses and order details, after it confirmed the incident on Friday following a review of API activity with Shopify. The company said it has blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers, but did not disclose how many were impacted. Security researcher Taylor Monahan warned the leaked addresses could expose holders to physical attacks and kidnappings, and blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from the same period last year. Some customers said they received breach notices despite buying devices more than two years ago, raising questions about Keystone’s 2023 pledge to cut data retention to 180 days. Keystone had not responded to Cointelegraph’s questions by publication time.
- Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis
Ledger said LTE-enabled implants in wallets sold by CryptoBilis captured the 24-word recovery phrases shown on device screens during setup and sent them over cellular networks via an eSIM, without compromising the secure chips or altering transactions. The issue came to light after crypto losses involving devices sold through the reseller, which is listed as authorized in Indonesia, Malaysia and the Philippines. Blockchain investigator Specter estimated losses could exceed $86 million, while Yfarmx put them at $103 million, though Ledger has not confirmed a total. CryptoBilis halted sales of all hardware wallet brands in those three countries, Trezor said it received no reports of tampered devices but removed the reseller, and OneKey terminated its authorization and offered free replacements for devices bought from CryptoBilis in 2026. Ledger is also examining reports beyond the reseller, including European cases involving devices bought from MediaMarkt, but has not confirmed a link.
- Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers
Bitcoin wallet Electrum released version 4.8.3 on October 24 to patch a high-severity flaw that let malicious servers inject fake transactions and trick users into paying attacker addresses; all versions before 4.8.3 are affected. Attackers can grind the fake transaction's output address to match the last four characters of the intended destination, so anyone checking only the tail of a long address could see an apparent match. At least one user confirmed losing funds on October 18 after fee-bumping a manipulated transaction, while a separate report on October 11 caused no loss because the transaction never spread beyond the local server. The patch verifies signatures on wallet-owned inputs before showing unconfirmed transactions, but incoming transactions from external senders still lack signature verification, a gap the developer acknowledged needs more work. Users who connect only to servers they run themselves are not affected, and those who cannot update should carefully check addresses and amounts before signing.
- India’s CoinDCX Confirms $16 Million Loss Days After CEO Called It a ‘False Alarm’
Indian crypto exchange CoinDCX has admitted losing 15.99 million USDT (about $16 million) on Oct. 21 in an incident involving its wallet infrastructure, after an internal process failed to sweep customer deposits out of wallets it had retired following a 2025 hack. The admission reverses CEO Sumit Gupta's earlier claim that the reports were a 'false alarm' and that the wallets had not been breached. The company said it has absorbed the loss itself and that customer funds remain safe. Together with the roughly $44 million hack in July 2025, the exchange's losses across the two incidents now total nearly $60 million.
- PHP flaw shows AI ‘vulnerability apocalypse’ is on schedule: Immunefi CEO
Immunefi CEO Mitchell Amador warned that internet users remain exposed to exploits from the PHP vulnerability for weeks, particularly through smaller websites slow to install the emergency upgrade shipped last Wednesday. He said finding vulnerabilities has become cheap while fixing them remains expensive, and advised users not to reuse passwords, to be cautious when connecting crypto wallets to websites, and to revoke unrecognized token approvals. Cloudflare’s CEO Matthew Prince said its network saw millions of exploit attempts in the 24 hours after the flaws were disclosed and thousands even before. PHP powers about 69% of websites with a known server-side language, according to W3Techs, and the FBI warned the flaws may allow attackers to remotely execute code.
- India's largest crypto exchange absorbs $16 million loss from internal process failure tied to retired wallet
India's largest crypto exchange, CoinDCX, says it absorbed a loss of 15.99 million USDT (about $16 million) after an internal service failed to move customer deposits out of a retired wallet compromised in a 2025 security breach. The exchange initially dismissed reports of suspicious outflows as a false alarm, but later acknowledged that users kept sending funds to the deprecated addresses. CoinDCX said customer balances, active wallets and trading systems were unaffected, and admitted it could have disclosed the incident more quickly.
Related markets
Latest news
- VSE Corporation, Viavi Solutions, Moog, Bloom Energy, and Comfort Systems stocks trade up, what you need to know
U.S. stocks rose across the board as investors looked ahead to a busy week, with about 36% of S&P 500 companies reporting quarterly results and the Federal Reserve due to decide on rates Wednesday. Money markets put a 90% probability on the Fed holding rates steady, and analysts expect S&P 500 earnings to jump 30% in the third quarter from a year earlier. Among the movers, VSE Corporation (VSEC) rose 4.2%, Viavi Solutions (VIAV) and Bloom Energy (BE) each gained 6.7%, Moog (MOG.A) climbed 4.3%, and Comfort Systems (FIX) advanced 7.2%. Falling Treasury yields supported the rally, and BondBloxx Investment Management viewed the expected Fed hold as a temporary pause rather than the end of tightening.
- Elon Musk Ally Jason Calacanis Targets 40% Tesla Rally — But His Nearly $1M Uber Bet Aims Higher
Early Uber investor Jason Calacanis disclosed purchases of about $1 million each in Uber and Tesla, plus 3,000 Netflix shares, for a total of $2.24 million. He bought 15,000 UBER shares at $65 for $975,000 with a 12-month target of $120, implying 85% upside, and 3,000 TSLA shares at $357 with a $500 target, implying about 40% upside. Calacanis predicted Tesla would hold 40% of the autonomous vehicle market, Uber and its partners 35%, and Waymo 15%, and said the Uber trade depends on price: “If Uber was at $100, I wouldn’t make this trade.” He also expects Waymo to buy Lucid or Rivian, two of several small autonomous-vehicle positions he disclosed last month.
- Anthropic’s S-1 Draws Reactions: Investor Says $100B ARR Could Be Possible By Year-End
Anthropic published its S-1 on Monday ahead of an IPO that could come as soon as next month, with broadly positive reactions from analysts and investors. The filing showed about $16.3 billion in revenue for the six months ended June 30, up from $1.2 billion a year earlier, and more than 1,900 customers paid at least $1 million over the past year. The company posted an $80.7 billion net loss in the first half, largely driven by a $72.4 billion accounting charge tied to convertible notes. Daniel McCarthy pointed to an 85.4% gross margin and an 8.4% GAAP operating margin in Q2, while Gavin Baker said ARR could reach $100 billion by year-end. Shares are expected to list on Nasdaq under the ticker “ANT,” with Goldman Sachs and Morgan Stanley leading 20 other underwriters.
- Former German Vice Chancellor Takes Senior Role at Vietnamese Securities Firm
HD Securities (HDS) elected Philipp Roesler, a former German Vice Chancellor, as Vice Chairman of its Board of Directors effective October 23, for the remainder of the 2025-2030 term. Roesler served as Vice Chancellor and Minister of Economics and Technology under Angela Merkel and previously held roles at Siemens, Deutsche Bank and Lufthansa. HDBank owns 90% of HDS, which reported nine-month operating revenue of VND 3,018 billion and pre-tax profit of VND 2,241 billion, up 2.6 and 3.7 times year on year, and has completed its annual plan. The company plans an IPO in Q4 2026, offering 121.79 million shares (11.11% of outstanding shares) at a minimum price of VND 12,252 per share to raise at least about VND 1,492 billion. If completed, charter capital would rise from VND 10,961 billion to VND 12,178 billion.
- French Government Pledges Change After Protests Turn Violent
The French government pledged to overhaul the national online university admissions platform, with significant changes in 2027 before it is formally replaced in 2028. Minister Philippe Baptiste also committed a 4.5 billion USD loan to renovate schools, reduce class sizes and increase student grants. The concessions aim to ease weeks of protests that began with students and spread to workers demanding relief from rising living costs, following the October 17 unrest that saw Limoges' city hall gutted by fire. About 2,400 people have been arrested, while protest leaders say the proposed measures have not met their demands. The unrest has also spread to Belgium, Albania and Italy.
- Morning of Oct 27: ACB Posts VND 16,600 Billion Profit; 12 Banks' Reported Profits Top VND 110,000 Billion
As of the morning of October 27, 12 banks had reported nine-month 2026 profits totaling over VND 110,000 billion, showing a clear divergence across the sector. ACB posted pre-tax profit of over VND 16,600 billion, up more than 3% and reaching 74% of its full-year plan; OCB reported VND 4,123 billion, up over 20%, completing 59% of its plan. LPBank posted pre-tax profit of VND 10,421 billion, up nearly 9%, completing about 70% of its annual plan against a full-year target of VND 14,982 billion. Kienlongbank earned pre-tax profit of VND 1,713 billion, up 11.5%, but its third-quarter profit fell 12.7% year on year. Saigonbank's nine-month pre-tax profit was nearly VND 66 billion, down nearly 75%, reaching only 21% of its annual plan.
Get the briefing on Telegram or Zalo
Join the Upside Telegram channel or Zalo group for the Vietnam stocks and gold briefing at 8:00 and 19:00 (Vietnam time) on trading days, plus a weekly wrap on Saturday morning.