Keystone's Nexus app hit by cyberattack, its third security scare in two weeks

Keystone is telling Nexus app users to grab version 1.3.7 after a cyberattack knocked out some of the app's services. The hardware wallet maker posted on X on Friday, November 6, saying the team responded fast and tightened up server security. According to Keystone, its investigation turned up "no evidence that user assets or personal information were affected." The company apologized for the outage and told anyone downloading the app to check that "Yanssie HK Limited" is listed as the developer — anything else isn't theirs.

The run of bad news started earlier with Keystone's Shopify-powered store. Unauthorized access was spotted on October 20, a third party pulled customer shipping data on October 23, and the company went public a day later. Names, contact details, shipping addresses and order information — including which devices buyers picked — were swept up. Keystone said payment cards, bank details, recovery phrases and private keys stayed out of reach. Reported figures put 25,964 buyer records from 2024 through 2026 in the haul, plus 12,873 unpaid checkout records counted as a precaution.

Home addresses in that leak set off alarms. Security researcher Taylor Monahan warned it could expose holders to "wrench attacks" — physical threats used to force someone into handing over crypto. Crypto security platform Certik counted 52 of those attacks in the first half of 2026, up from 39 in the previous year.

Then came the WebAuth key. Keystone said the same attacker behind the store breach also grabbed the key its devices use to prove they're genuine, reportedly by exploiting a flaw in a third-party monitoring tool to escalate privileges. The problem is baked in: the key is burned into each device during manufacturing and can't be rewritten, so anyone holding it could build a fake that sails through Keystone's own authenticity check. Keystone scrapped all 18,835 unsold units carrying the compromised key. Wallets delivered before October 20 that pass the check are genuine, but for old-key units received after that date the company "cannot completely rule out the possibility that it is counterfeit" and told owners to contact support before use.

There's a data retention mess too. Keystone had advertised that shipping data gets wiped 180 days after an order, yet customers reported breach notices for purchases more than two years old — its automated erasure tool failed and left the old records sitting there. The company now keeps data for 90 days, down from 180, and asked Shopify to delete anything older, with the overdue records expected to be gone by November 3. Rival OneKey responded by capping its own retention window at 30 days.

Keystone isn't alone in a rough 2026 for crypto security. In August, a breach at logistics partner ShipMonk hit around 81,000 Trezor customers. SafePal exposed about 39,798 people through an order-tracking flaw, and Ledger found hidden chips in resold devices that on-chain researchers tied to losses above $86 million.