Chelsea Perry

"Cold" Stopped Meaning Safe? 18k brand new hardware wallets are about to be destroyed Keystone confirmed that whoever broke into its website left with more than the customer list hackers also accessed their webath key that is written into every device that makes the official checker identify it as a genuine one that key can't be erased or swapped on devices already built. so every unsold unit carrying it gets destroyed Keystone is now the second wallet maker this year to destroy its own stock, Coldcard did the same this summer what got stolen: - 25,964 buyer records from 2024 to 2026 with names, contacts, shipping addresses and order info - 12,873 unpaid checkouts that may also be exposed part of that data should have been deleted long ago, but Keystone's auto-delete tool broke and nobody noticed it why the key is the real problem? ~26k buyer records with shipping addresses, and the key that lets a fake device pass the authenticity check. that's everything you need to mail someone a "replacement" Keystone that verifies and sends your seed and this whole playbook is older than you think in 2021 people from Ledger's leaked 272k customer list started getting tampered nano Xs in the mail, with a fake letter signed by the CEO. the only thing that scam ever lacked was a fake that passes the check meanwhile only two of this year's other breaches were connected to real flaws in the device itself: 1. Coldcard shipped a firmware bug in 2021 that made seeds guessable 2. Tangem got its card passwords reset by Ledger Donjon with laser everything else came through the stuff wrapped around the device - Trezor's shipping partner shipmonk got breached (~81k customers) - then Trezor's newsletter tool was hijacked to send a fake alert to 347k inboxes, and ~2,500 anons clicked - Safepal leaked 39,798 customers' order data through a plugin flaw - same week as Keystone, Foundation flagged 23k+ phishing emails made to look legit Keystone, Safepal and Foundation all admitted the same thing: their data deletion was broken, so part of what leaked shouldn't have even existed anymore here's what you can do to minimize the risks: • buy directly from the manufacturer • a device you didn't order = scam • seed card already in the box = trash it. legit device always generates a fresh one • add a strong bip39 passphrase • ship to a pickup point, not your home. your leaked address is a potential wrench attack target • use a 2-of-3 multisig for serious bags. if each key is on different vendor, single exposure won't end up losing your funds if your vendor isn't on this year's list yet, enjoy it while it lasts