Keystone Issues Warning Following Cyberattack on Nexus App

Keystone has urged users to update their Nexus app to the latest version, 1.3.7, in response to a cyberattack that disrupted some app functionalities. This incident marks the third security-related announcement from the hardware wallet maker in a short span of two weeks.

Details of the Nexus App Cyberattack

On November 6, Keystone disclosed via X that certain services of the Nexus App were compromised during the recent cyberattack, which resulted in a temporary inability for users to access the application. In their response, the company reported that server security had been enhanced to prevent further issues. Fortunately, they noted, “we found no evidence that user assets or personal information were affected” during their investigation.

In light of the disturbance, Keystone apologized and encouraged users to ensure they are downloading the app developed by “Yanssie HK Limited,” warning that any version without this developer reference may not be legitimate.

A Sequence of Security Breaches

This cyberattack follows earlier disclosures relating to security compromises at Keystone. The initial incident involved unauthorized access to their Shopify-powered online store, which was detected on October 20. By October 23, it was confirmed that customer shipping data had been accessed by a third party, prompting Keystone to alert the public the very next day.

The breach is reported to have involved the records of approximately 25,964 customers, including their names, contact information, shipping addresses, and order details. However, sensitive information such as payment card details, bank information, recovery phrases, and private keys remained secure.

Concerns were raised by security researcher Taylor Monahan, who indicated that the leaked home addresses could leave customers vulnerable to “wrench attacks,” where physical threats are used to coerce cryptocurrency owners into relinquishing their assets. Notably, Certik, a crypto security platform, recorded 52 such attacks in the first half of 2026, up from just 39 in the previous year.

Destruction of Compromised Hardware Units

Shortly after the store breach, Keystone faced further challenges. They reported that the same cybercriminal had gained access to the WebAuth key, crucial for authenticating their devices. This breach potentially allowed the creation of counterfeit devices capable of passing Keystone’s authenticity tests.

To mitigate the threat, Keystone opted to destroy all 18,835 unsold hardware wallets containing the compromised key. Users with wallets manufactured after October 20 were advised to reach out to support before use, despite reassurances that older delivered units confirmed as authentic remain safe.

Data Retention Policy Revised

In light of these incidents, Keystone re-evaluated its data retention practices. Originally promising to delete shipping data after 180 days, they found that an automated deletion tool had failed, leading to notifications being sent out to customers regarding data breaches on orders from over two years ago.

Following this issue, Keystone reduced its data retention period to a streamlined 90 days and requested Shopify to assist in deleting older records, with expectations for compliance by November 3. As a result of the security breach, OneKey, a competing hardware wallet provider, also implemented a 30-day data retention limit.

Broader Context of Cybersecurity Threats in Crypto

The incidents involving Keystone are part of a troubling trend in 2026, where multiple crypto businesses have experienced significant cybersecurity threats. Recent examples include a data breach at ShipMonk, affecting around 81,000 customers of Trezor, along with SafePal exposing data from approximately 39,798 customers due to an order-tracking vulnerability, and Ledger encountering issues with counterfeit chips in resold products linked to over $86 million in losses.