• Keystone urged users to update its Nexus app to version 1.3.7 after a cyberattack disrupted services, saying it found no evidence of compromised assets or personal data.
  • The incident follows a breach exposing 25,964 customer records and the theft of a device authentication key, which forced Keystone to scrap 18,835 unsold hardware wallets.
  • Keystone also cut its customer data retention period from 180 to 90 days after discovering its automated deletion system had failed.

 

Keystone has told users to update its Nexus app to version 1.3.7 after a cyberattack disrupted some of the app’s services.

It is the third security disclosure that the hardware wallet maker is making in roughly two weeks.

The Nexus App attack and the v1.3.7 fix

Keystone posted on X on Friday, November 6, that some Nexus App services were hacked by a cyberattack and that a number of users could not run the app for a stretch.

It said that the team had responded and hardened server security. The company wrote that it “found no evidence that user assets or personal information were affected,” following its investigation.

Keystone apologized for the interruption and directed users to update their app to v1.3.7. It also added that users should confirm that the app that they are downloading has “Yanssie HK Limited” listed as the developer. It said any other app without that developer is not from them.

A store breach that exposed 25,964 buyer records

The first disclosure came when Keystone admitted an intruder had reached its Shopify-powered online store.

Unauthorized access was detected on October 20. The company confirmed that a third party had pulled customer shipping data on October 23, and it went public with that information the following day.

The stolen records held names, contact details, shipping addresses and order information, such as which devices buyers purchased.

The company said that payment cards, bank details, recovery phrases and private keys were not exposed.

It was reported that 25,964 buyer records from purchases dating 2024 to 2026 were among the stolen records. The company also counted 12,873 unpaid checkout records as a precaution.

Home addresses were part of the leak, and it prompted security researcher Taylor Monahan to point out that it could put holders at risk of “wrench attacks,” physical threats used to force owners to hand over crypto.

Crypto security platform Certik tracked 52 of such attacks in the first half of 2026. Only 39 of such incidents were recorded in the previous year.

18,835 wallets headed for destruction

A few days after disclosing the theft of user records, Keystone was in the news again, as it said that the same attacker that was responsible for the first attack had also taken the WebAuth key that its devices use to prove they are genuine.

The attacker reportedly exploited a flaw in a third-party monitoring tool on the website to escalate privileges, then grabbed both customer data and the key.

The main issue is that the key is burned in each device during manufacturing and cannot be rewritten.

Anyone with the key could build a fake device that passes Keystone’s own authenticity check. Keystone decided to scrap all 18,835 unsold units carrying the compromised key

The company said a wallet delivered before October 20 that passes the check is genuine. For old-key units received after that date, it “cannot completely rule out the possibility that it is counterfeit,” and it told those owners to contact support before use. 

It has not reported any counterfeit devices or thefts so far.

Retention cut to 90 days after a deletion tool failed

Keystone had advertised that it wipes shipping data 180 days after an order. However, customers reported receiving breach notices for purchases more than two years old.

The company’s automated erasure tool failed and left the old records in place.

Keystone then reduced its retention window to 90 days as a result. It also asked Shopify to delete personal data older than that, with the overdue records expected to be gone by November 3.

Rival OneKey also capped its own retention window at 30 days following the Keystone incident.

Many crypto projects have had a difficult run in 2026 with respect to cyber attacks. Hardware wallet providers have not been left alone.

In August, a data breach that affected ShipMonk, one of Trezor’s logistics partners, affected around 81,000 customers.

SafePal exposed about 39,798 through an order-tracking flaw, and Ledger found hidden chips in resold devices that on-chain researchers tied to losses above $86 million.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

FAQs

What should Nexus App users do now?

Keystone told users to update the Nexus App to version 1.3.7 after a cyberattack disrupted some of the app's services, according to its post on X.

How many devices is Keystone destroying, and why?

Keystone is scrapping 18,835 unsold wallets that carry a stolen authentication key, because the key is burned into each device during manufacturing and cannot be rewritten.

What customer data was exposed in the store breach?

Names, contact details, shipping addresses and order details across 25,964 buyer records from 2024 to 2026 were exposed, while payment cards, recovery phrases and private keys were not.

Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.

Hannah Collymore

Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.

5 Ingenious Applications of ChatGPT And What You Should Do About Them

93% Business Leaders Favor AI-Powered Solutions for Brand Sustainability Management, Reuters

Here’s How Macron Supports France’s Vibrant and Productive AI Ecosystem

Bloomberg Estimates the Generative AI Market to Reach $1.3 Trillion by 2032