Keystone has told users to update its Nexus app to version 1.3.7 after a cyberattack disrupted some of the app’s services.
It is the third security disclosure that the hardware wallet maker is making in roughly two weeks.
The Nexus App attack and the v1.3.7 fix
Keystone posted on X on Friday, November 6, that some Nexus App services were hacked by a cyberattack and that a number of users could not run the app for a stretch.
It said that the team had responded and hardened server security. The company wrote that it “found no evidence that user assets or personal information were affected,” following its investigation.
Keystone apologized for the interruption and directed users to update their app to v1.3.7. It also added that users should confirm that the app that they are downloading has “Yanssie HK Limited” listed as the developer. It said any other app without that developer is not from them.
Screenshot of the legitimate Keystone app on the App Store. Source: Keystone via X/Twitter
A store breach that exposed 25,964 buyer records
The first disclosure came when Keystone admitted an intruder had reached its Shopify-powered online store .
Unauthorized access was detected on October 20. The company confirmed that a third party had pulled customer shipping data on October 23, and it went public with that information the following day.
The stolen records held names, contact details, shipping addresses and order information, such as which devices buyers purchased.
The company said that payment cards, bank details, recovery phrases and private keys were not exposed.
It was reported that 25,964 buyer records from purchases dating 2024 to 2026 were among the stolen records. The company also counted 12,873 unpaid checkout records as a precaution.
Home addresses were part of the leak, and it prompted security researcher Taylor Monahan to point out that it could put holders at risk of “wrench attacks,” physical threats used to force owners to hand over crypto.
Crypto security platform Certik tracked 52 of such attacks in the first half of 2026. Only 39 of such incidents were recorded in the previous year.
18,835 wallets headed for destruction
A few days after disclosing the theft of user records, Keystone was in the news again, as it said that the same attacker that was responsible for the first attack had also taken the WebAuth key that its devices use to prove they are genuine.
The attacker reportedly exploited a flaw in a third-party monitoring tool on the website to escalate privileges, then grabbed both customer data and the key.
The main issue is that the key is burned in each device during manufacturing and cannot be rewritten.
Anyone with the key could build a fake device that passes Keystone’s own authenticity check. Keystone decided to scrap all 18,835 unsold units carrying the compromised key
The company said a wallet delivered before October 20 that passes the check is genuine. For old-key units received after that date, it “cannot completely rule out the possibility that it is counterfeit,” and it told those owners to contact support before use.
It has not reported any counterfeit devices or thefts so far.
Retention cut to 90 days after a deletion tool failed
Keystone had advertised that it wipes shipping data 180 days after an order. However, customers reported receiving breach notices for purchases more than two years old.
The company’s automated erasure tool failed and left the old records in place.
Keystone then reduced its retention window to 90 days as a result. It also asked Shopify to delete personal data older than that, with the overdue records expected to be gone by November 3.
Rival OneKey also capped its own retention window at 30 days following the Keystone incident.
Many crypto projects have had a difficult run in 2026 with respect to cyber attacks. Hardware wallet providers have not been left alone.
In August, a data breach that affected ShipMonk, one of Trezor’s logistics partners, affected around 81,000 customers.
SafePal exposed about 39,798 through an order-tracking flaw, and Ledger found hidden chips in resold devices that on-chain researchers tied to losses above $86 million.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It’s free .
