Your Hardware Wallet Keeps Your Keys Offline. Your Shipping Label Doesn't.

Two security scares in one week. Not a single seed phrase touched. That's the good news, and it's also the warning.

Keystone leaked its customers' names and home addresses. Electrum patched a flaw that let rogue servers trick users into paying thieves. Neither one cracked a key. Both went after the stuff sitting around the keys: who knows where you live, and whose server you trust to tell you what's true.

Picture the call. Someone says they're with law enforcement. They know your name. They know your address. They know you bought a hardware wallet in 2024, and they know which one. Your private keys have been exposed, they say, and they're about to text you a secure link to fix it.

That's not a hypothetical. One Keystone customer described a call like that on X this past weekend, apparently built from the details of a 2024 order.

Here's the strange part. Keystone's devices did their job. The keys never left them. The problem was with the shipping label.

What Keystone actually lost#

On October 20, Keystone detected unauthorized access to its official website. After checking API activity with Shopify, it confirmed on October 23 that a third party had pulled customer shipping records. On October 24 it went public with a post that opened, to its credit, with "We owe you an apology."

What leaked: names, contact details, shipping addresses, and order details, including what people bought and what they paid.

What didn't: recovery phrases, private keys, wallet passwords, and payment card or bank details.

Keystone hasn't said how many customers were affected, or exactly how the attacker got in beyond saying it fixed "the underlying vulnerability." A fuller report is promised.

But one detail deserves a harder look. Back in 2023, after other wallet makers got burned, Keystone publicly committed to deleting customer shipping data 180 days after an order. Now customers are reporting breach notices for orders placed 214 days ago, and in some cases more than two years ago. When Cointelegraph asked how data older than 180 days ended up exposed, Keystone hadn't answered by publication.

Maybe there's an explanation. (Privacy policies have a way of saying slightly different things than the blog posts announcing them.) But if a company promised your address would be gone and it wasn't, that's the whole story in miniature. You can't verify a deletion. You can only trust it.

Four wallet makers, one pattern#

It's been a rough year for anyone who typed their address into a wallet maker's checkout page.

• January: Ledger customers learned their names and contact details were exposed through Global-e, the e-commerce partner handling Ledger.com orders.
• August: Trezor disclosed a breach at ShipMonk, its shipping provider. The count later grew to about 81,000 customers, including US orders going back to 2019. Why so far back? ShipMonk was supposed to delete that data and didn't. Trezor said it was "very disappointed that, despite receiving this confirmation, the data was not deleted."
• August, days later: SafePal said a flaw in its order-tracking plug-in exposed 39,798 customers' names, emails, phone numbers and shipping addresses.
• October: Keystone.

That's more than 120,000 known addresses exposed this year, before counting Ledger or Keystone, neither of which has published a number.

Notice what's missing from every one of those incidents? A cracked device. A broken seed. Two leaked through partners (an e-commerce provider and a shipper), two through the storefront itself. And in at least one, maybe two, the data was supposed to be gone already.

Meanwhile, at Electrum#

The same weekend, Electrum shipped version 4.8.3 and published a security advisory with a title that reads like a heist plot: "Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it."

You see, Electrum is a light wallet. It doesn't download the whole blockchain. It asks a server what's happening, and by design it trusts that server about unconfirmed transactions. Most people never change the default, so they're connected to whatever public server their wallet picked.

Here's how the attack worked, step by step:

• You send a payment. Your wallet hands it to the server. A malicious server simply sits on it. It never reaches the network.
• The server tells your wallet about a different transaction instead, spending the same coins to the attacker's address. Its signatures are fake, but older Electrum versions didn't check signatures on pending transactions.
• Your history now shows the fake as "unconfirmed." Your real payment has vanished.
• In the theft that was reported, the fake carried a zero fee, so it looked stuck. So you do the sensible thing and hit "Increase fee."
• Electrum re-signs the fake with a higher fee. Now it's a real, valid transaction. And it pays the attacker.

One more twist. The attacker's address was generated so its last four characters matched the real recipient's. If you only glance at the end of the address (and be honest, most of us do), it passes. We always preach the first and last 6 digits, which would have helped you here.

Electrum's developers said some servers were already running this in the wild. The first private report came October 11; a second user reported losing funds to a fee bump on October 18. The fix shipped October 24. Electrum hasn't disclosed how much was taken.

Now the detail I keep coming back to. The first person to report it was using a 2-of-3 multisig with two Trezors, and verified the outputs on both devices before broadcasting. The hardware did everything right. The real transaction just never left the server.

And the clients that were never exposed at all? In the advisory's words, those connected to trusted servers, "such as servers they run themselves."

This isn't Electrum's first run-in with hostile servers, either. In late 2018 and into 2019, attackers flooded the network with malicious servers that pushed fake "update" pop-ups to users, linking to poisoned wallet downloads. Malwarebytes tallied well over 771 BTC stolen. Different trick, same doorway.

The security hole is the middleman#

In 2001, years before Bitcoin, Nick Szabo wrote a short essay with a title that's aged like a prophecy: "Trusted Third Parties are Security Holes."

His argument was simple. Every time a system's design assumes some third party will behave, that assumption "constitutes the introduction of a security hole into that design." Not a theoretical one. A real one, because the trusted party is exactly where an attacker will push. Szabo went further: those trust assumptions "cause most of the costs and risks in a security protocol." And then the line that reads like a design brief for Bitcoin itself: "The best 'TTP' of all is one that does not exist, but the necessity for which has been eliminated by the protocol design."

That's what self-custody does for your keys. There's no bank to freeze them, no exchange to lose them. The trusted third party has been designed out.

But look at this week again through Szabo's lens. Keystone's customers still had two trusted third parties they'd never really thought about. The store and shipper holding their address. And for Electrum users, the server holding their view of the blockchain. Neither held a key. Both turned out to be holes.

So self-custody isn't a single box you tick when you set up a hardware wallet. It's a habit of asking, everywhere: who am I trusting here, and do I actually need to? (I'll admit I learned this the slightly embarrassing way, years ago, when I realized I'd been carefully hiding my seed backup while running my wallet off a server I couldn't have named.)

Why an address is worth more than it looks#

It's tempting to shrug at an address leak. But a leaked wallet-buyer list isn't a phone book. It's a list of people who own bitcoin and care enough to secure it, with their front doors attached.

We've seen where that leads. In December 2020, contact details for 272,853 Ledger buyers were dumped on a hacking forum. By June 2021, scammers were mailing tampered Ledger devices in convincing shrink-wrapped boxes, with a letter citing the real leak and telling recipients to plug in and enter their recovery phrase. The leak is what made the lie believable. It's exactly why Keystone is now warning customers about fake "replacement devices."

And it gets physical. CertiK counted 52 verified wrench attacks (people coerced in person into handing over crypto) in the first half of 2026, up from 39 a year earlier. Home invasions went from one to 20. CertiK's report ties much of that to leaked databases that hand crews ready-made target lists, and it treats data minimization as a physical-safety measure.

That's the real threat model now. Not someone guessing your seed. Someone knowing where you sleep.

The checklist#

None of this needs paranoia. It needs a few habits.

Protect your address#

• Don't ship to your home. Use an office, a PO box, a mailbox service, or a pickup option like Canada Post FlexDelivery. Use a name that doesn't tie a wallet to your front door, where that's lawful.
• Ask vendors to delete your data. Where privacy law gives you that right, use it. Then assume it might not happen, because twice this year it apparently didn't.
• Treat every "your wallet is compromised" contact as hostile. Phone, text, email, or a letter in your mailbox. Refunds, replacement devices, "security updates." No legitimate company needs your seed phrase. Ever.
• Never use a device you didn't order. And never type your recovery phrase into anything except the device it belongs to.
• Plan for the knock on the door. Don't advertise your stack. Consider a passphrase wallet, and for larger holdings, multisig spread across locations, so no single door opens everything.

Choose your server#

• Update Electrum to 4.8.3 or later. Download only from electrum.org and verify the signatures.
• Run your own server. Fulcrum, electrs or Electrum Personal Server on your own node (a plug-and-play node box works fine) and point your wallet at it. That's the one setup the advisory says was never at risk.
• Read the whole address on your hardware wallet screen. Every time. Including fee bumps. Four characters isn't verification.
• If a payment vanishes and a strange one appears, stop. Don't bump anything. Check a block explorer, ideally your own, before you sign again.

If this is starting to sound like a lot, it's the same lesson we keep landing on. This summer it was the Coldcard entropy failure, where the keys themselves were weak. This month the keys were fine and everything around them leaked. Different layer, same principle: the list is the weapon, and the less of you that's on someone else's list, the safer you are.

Your keys were never the whole story#

Holding your own keys is still the foundation. Nothing this week changed that. None of these leaks handed an attacker anyone's coins directly, because no store and no shipper ever held them.

But sovereignty doesn't stop at the seed. It covers what you hand over to buy the device, and whose word you take for what's on the chain. Szabo's rule holds at every layer: the safest trusted third party is the one you never needed.

Not your keys, not your coins. Not your server, not your truth.

At Bitcoin Well we never hold your keys, and we think the same rule applies to everything else: the less anyone keeps about you, us included, the less there is to leak.

A note on sourcing#

Keystone. Timeline, exposed and unexposed data, and quotes are from Keystone's October 24, 2026 disclosure on X, as reported by Crowdfund Insider and Cointelegraph (both October 2026). The 2023 180-day retention commitment, the unanswered question, and the law-enforcement impersonation call are from Cointelegraph. The 214-day and two-year customer reports are customer accounts relayed by FinanceFeeds and Cointelegraph and haven't been confirmed by Keystone.

The 2026 pattern. Ledger/Global-e from The Block (January 5, 2026). Trezor/ShipMonk, the 81,000 figure and Trezor's quote from BleepingComputer (September 2026). SafePal from The Block (August 16, 2026). The 120,000 figure is Coin Bureau's tally, which matches Trezor plus SafePal.

Electrum. Mechanism, timeline and quotes are from Electrum's GitHub security advisory GHSA-6jp4-8v48-cc5v (published October 24, 2026), with supporting coverage from Crowdfund Insider and DeFiPrime. The 2018 to 2019 phishing figures are from Malwarebytes (April 2019). The illustration above is ours; commands and addresses are simplified.

Ledger 2020 and 2021. BleepingComputer's coverage of the RaidForums dump and the tampered-device mailings (June 2021).

Wrench attacks. CertiK's H1 2026 report as covered by Decrypt (July 23, 2026).

Szabo. "Trusted Third Parties are Security Holes" (2001), quoted from the Nakamoto Institute archive.

Originally published at bitcoinwell.com/blog