Keystone disclosed on Saturday, October 24, that its website had suffered unauthorized access, exposing customer contact data and shipping addresses tied to orders. The company said private keys and recovery phrases were not exposed in the incident. The disclosure makes Keystone the sixth hardware wallet brand to report a security incident in 2026, a year that has tested the sector European crypto holders rely on to keep assets offline.
The list of affected manufacturers now spans much of the market. Ledger was first, after its e-commerce provider Global-e suffered a data leak reported on January 5, exposing customer names, contact details, shipping addresses and order details. Ledger returned to the headlines on October 10, when it confirmed a case of physical tampering involving a device sold through a distributor. The tampered unit contained an unauthorized component capable of capturing recovery words during setup and transmitting them to third parties, a scenario that, if exploited at scale, would undermine the core promise of a hardware wallet.
Trezor and SafePal data leaks
Trezor reported a breach linked to its fulfilment partner ShipMonk on August 13, a scope later expanded to cover 80,689 affected customers. The same month, on August 16, SafePal disclosed a vulnerability in its order tracking system that exposed data for approximately 39,798 customers, including names, addresses, contact information and purchase details.
Trezor also suffered unauthorized access to its Brevo marketing account, reported in August, affecting tens of thousands of customers' data. The company linked the incident to subsequent phishing campaigns in which attackers attempted to trick users into handing over sensitive wallet information. BitBox reported a similar Brevo-related incident on September 24, saying attackers downloaded subscriber email addresses later used to distribute phishing messages. BitBox said its devices and internal systems were not compromised.
A $116 million flaw in COLDCARD
The most financially damaging incident of the year involved COLDCARD. On July 30, the company disclosed a vulnerability related to cryptographic seed generation, stemming from insufficient randomness that could, under certain conditions, allow reconstruction of private keys and theft of funds. Losses attributable to the flaw have been put at approximately $116 million.
Taken together, the incidents illustrate two distinct pressure points on hardware wallet providers: third-party vendors handling logistics and marketing data, and the cryptographic and physical integrity of the devices themselves. For European users, who have increasingly turned to hardware wallets amid regulatory scrutiny of custodial exchanges, the pattern underscores that self-custody shifts risk rather than eliminating it.
