Hardware wallet maker Keystone has urged users to update its Nexus app to version 1.3.7 after a cyberattack disrupted some of the application's services. Announced on Friday, November 6, it is the third security disclosure the company has issued in roughly two weeks, following a customer-data breach at its online store and the theft of a key used to verify that its devices are genuine.

The Nexus app attack and the v1.3.7 fix

In a post on X, Keystone said that some Nexus App services had been compromised in a cyberattack and that a number of users were unable to run the app for a period of time. The company said its team had responded to the incident and hardened server security. Keystone's announcement did not detail which services were affected or attribute the attack.

Following an investigation, Keystone wrote that it "found no evidence that user assets or personal information were affected." The company apologized for the interruption and directed users to update the app to v1.3.7. It also advised users to confirm that any app they download lists "Yanssie HK Limited" as the developer, adding that an app without that developer listed is not from Keystone.

A store breach that exposed 25,964 buyer records

The first disclosure concerned an intruder reaching Keystone's Shopify-powered online store. According to Cryptopolitan's earlier reporting, unauthorized access was detected on October 20, and on October 23 the company confirmed that a third party had pulled customer shipping data, going public with the information the following day.

The stolen records contained names, contact details, shipping addresses, and order information, including which devices buyers had purchased. The company said payment cards, bank details, recovery phrases, and private keys were not exposed.

It was reported that 25,964 buyer records from purchases dating from 2024 to 2026 were among the stolen data. Keystone also counted 12,873 unpaid checkout records as a precaution.

Because home addresses were part of the leak, security researcher Taylor Monahan pointed out that it could put holders at risk of "wrench attacks" — physical threats used to force owners to hand over their crypto. Crypto security platform Certik tracked 52 such attacks in the first half of 2026, compared with 39 incidents recorded in the previous year.

18,835 wallets headed for destruction

Days after disclosing the theft of user records, Keystone said the same attacker responsible for the first breach had also taken the WebAuth key its devices use to prove they are genuine. The attacker reportedly exploited a flaw in a third-party monitoring tool on the company's website to escalate privileges, then grabbed both customer data and the key.

The problem is significant because the key is burned into each device during manufacturing and cannot be rewritten. Anyone holding the key could build a fake device that passes Keystone's own authenticity check. In response, Keystone decided to scrap all 18,835 unsold units carrying the compromised key.

The company said a wallet delivered before October 20 that passes the check is genuine. For units with the old key received after that date, it "cannot completely rule out the possibility that it is counterfeit," and it told those owners to contact support before use. It has not reported any counterfeit devices or thefts so far.

Retention cut to 90 days after a deletion tool failed

Keystone had advertised that it wipes shipping data 180 days after an order, but customers reported receiving breach notices for purchases more than two years old, as Cryptopolitan reported. The company's automated erasure tool had failed, leaving the old records in place.

Keystone subsequently reduced its retention window to 90 days and asked Shopify to delete personal data older than that, with the overdue records expected to be gone by November 3. Rival OneKey also capped its own retention window at 30 days following the Keystone incident.

Crypto projects have had a difficult run of cyberattacks in 2026, and hardware wallet providers have not been spared. In August, a data breach at ShipMonk, one of Trezor's logistics partners, affected around 81,000 customers. SafePal exposed about 39,798 users through an order-tracking flaw, and Ledger found hidden chips in resold devices that on-chain researchers tied to losses above $86 million. Keystone's own two-week run of disclosures reflects that breadth, with the incidents spanning its storefront, its website tooling, its stock of unsold devices, and its app services.