Hardware wallet maker Keystone disclosed that an unauthorized third party accessed customer shipping information through Shopify’s API. The exposed data included names, contact details, shipping addresses and order information, but the company did not say how many customers were affected. Keystone blocked access, fixed the vulnerability and notified customers, while security researcher Taylor Monahan warned that the information could facilitate targeted scams, kidnappings and physical attacks. CertiK recorded 52 verified physical attacks against cryptocurrency holders in the first half of 2026, up 33% from the same period in 2025. Several customers also received notifications despite purchasing their devices more than two years ago, raising questions about Keystone’s announced policy of deleting customer data after 180 days.
Source: Read the original article
