Keystone Releases Nexus Update After Cyberattack

Keystone reported unauthorized interference with certain services of the Nexus application. Due to the cyberattack, some users were temporarily unable to use certain features. The company stated that specialists have strengthened server security, and the investigation did not reveal any signs of unauthorized access to cryptocurrency assets or users' personal information. To resolve the issue, Keystone recommended updating the application to version 1.3.7. When downloading, device owners should check the developer's name: the official app should be published by Yanssie HK Limited. Programs with other developer information are not Keystone products.

This is the third security incident reported by the company in approximately two weeks. Previously, Keystone confirmed a breach of its online store on the Shopify platform. Unauthorized access was discovered on October 20, and on October 23, the attacker uploaded delivery information of customers. The published data included names, contact details, addresses, order information, and purchased devices. The leak affected 25,964 customers who made purchases between 2024 and 2026. Additionally, the company accounted for 12,873 incomplete orders. According to Keystone, payment data, bank details, recovery phrases, and private keys were not disclosed.

It was later revealed that the same attacker gained access to the WebAuth key, which is used to authenticate Keystone devices. This key is embedded in the hardware during production and cannot be replaced. Its compromise created a risk of manufacturing counterfeit devices capable of passing authentication. As a result, the company decided to dispose of 18,835 unsold wallets. Keystone stated that devices delivered before October 20 and that passed verification are genuine. However, for wallets with the old key received after this date, the company could not completely rule out the possibility of counterfeiting and recommended that owners contact support before using them. No reports of counterfeit devices or thefts were reported at the time of publication.

An additional problem was the failure of automatic deletion of client data. Keystone claimed it deletes delivery addresses 180 days after order completion, but the leak included purchase information from more than two years ago. After discovering the error, the company reduced the data retention period to 90 days and asked Shopify to delete older records. This procedure was planned to be completed by November 3. Competing company OneKey limited the retention period of similar data to 30 days.

The incidents also affected other companies in the industry. In August, a leak at Trezor's logistics partner ShipMonk affected about 81,000 customers, and an error in SafePal's order tracking system exposed data of approximately 39,798 users. In the case of Ledger, researchers discovered hidden chips in resold devices; losses associated with them, according to researchers, exceeded $86 million.