Keystone says website breach exposed hardware wallet buyers’ addresses

Crypto hardware wallet maker Keystone has disclosed a website security breach that exposed customer information to attackers, raising concerns about targeted scams and physical attacks. Keystone said Saturday that it detected suspicious activity earlier in the week and confirmed Friday, after reviewing API activity with Shopify, that an unauthorized third party had accessed customer shipping information. This included names, contact details, shipping addresses and other order details, such as items bought. “We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” said the company.Keystone warned that the exposed information could be used for targeted phishing attacks. However, security researcher Taylor Monahan also raised concerns that leaking shipping addresses could expose customers to physical attacks and kidnappings. Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 during the same period last year. Such crimes, commonly called “wrench attacks,” involve using physical threats or violence to force cryptocurrency holders to surrender their assets. “Again, we’re truly sorry to everyone affected,” Keystone said. The company did not disclose how many customers were impacted. Keystone questioned over promise to delete customer dataThe breach has also raised questions about Keystone’s handling of older customer information. In a 2023 blog post, Keystone said it had reduced its customer data retention period to 180 days following security incidents affecting other hardware wallet manufacturers. However, some customers said they received breach notifications despite purchasing their devices more than two years ago, raising questions about what information Keystone retained and whether the notifications indicate that older order records were not deleted as promised. Related: Italy investigates government email breach linked to Revolut data leakAn X user going by “OG DEGEN” said they received a call from a scammer claiming they were law enforcement investigating a fraud case. The user suspected the caller obtained their information through a Keystone order placed in 2024, based on the personal information the caller referred to. “I think their plan was to convince me that my private keys had been exposed and then send me a phishing link to supposedly reset them,” they wrote on X. Another X user, trintaetres, also said they received the email notification despite buying the device over two years ago. Cointelegraph contacted Keystone to ask how customer information from purchases made more than 180 days earlier could have been exposed despite its previously announced retention policy, and how many customers were affected. The company did not respond by publication time. Magazine: AI agents help rescue ETH’s Glamsterdam fork, ‘Steal My Bitcoin’ site: Hodler’s Digest

Čítaj viac

AI agents help rescue ETH’s Glamsterdam fork, ‘Steal My Bitcoin’ site: Hodler’s Digest

AI agents message board set up to rescue Glamsterdam forkThe second and final testnet for Ethereum’s Glamsterdam hard fork was cancelled this week, after ChainSecurity found vulnerabilities in two gas scaling Ethereum Improvement Proposals that could have spelled big trouble for at least 13 DeFi contracts. The bugs were connected to EIP-8037/8038 and resulted in contracts that rely on the way gas currently behaves, breaking when a call runs out of gas. It’s all fairly technical and complicated, but the upshot is that an attacker may have been able to exploit the resulting vulnerabilities. The hard fork testnet dress rehearsal on Hoodi is not expected to be rescheduled until all the second order effects of the fork have been gamed out properly. In an article on X today, Derek Chiang from Eth Labs noted the vulnerability was found out at a few minutes to midnight, which is less than ideal, “causing everyone to scramble to deal with the fallout.”“In the future, protocol designers would do well to conduct much more thorough analysis of potential breakages that their update might introduce, and to do so much earlier in the process.”Chiang says two researchers from Eth Labs and the Ethereum Foundation had independently spun up a bunch of AI Agents to scan contracts for vulnerabilities. When they realized they were both employing the same strategy they “set up a message board for their agents in the form of a github repo” to coordinate the work. He noted the similarities to the OpenAI < > Hugging Face hack where rogue agents had set up a message board to coordinate the attacks. “Well, turns out the same pattern is useful for the good agents too,” he said. The exercise has been so successful at finding potential problems that a second board has been set up to examine the effects of EIP-8198, aka “Quick Slots”, which has been proposed for the subsequent Hegota hard fork.Steal My Bitcoin site aims to prove Bitcoin isn’t vulnerable to PHP2Shell scareA new website that hasn’t been patched for the PHP2Shell vulnerabilities hopes to prove that a Bitcoin wallet isn’t vulnerable to the biggest cybersecurity scare of the year. The ‘Steal My Bitcoin’ site has hidden the key to a Bitcoin wallet worth around $2000 which is accessible to the PHP user account through a binary called print-flag.Source: StealMyBitcoinAt the time of writing the site has been up for 25 hours without a successful hack, although it has periodically been offline due to heavy traffic and probing attempts. PHP is a programming language widely used to power websites and web applications, including content management systems. Government agencies and other organizations in the Netherlands, Australia, Japan, Finland and elsewhere took critical websites offline Wednesday as a precaution while emergency patches were developed for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging inSolana’s Alpenglow launches on mainnetSolana’s first major consensus upgrade, Alpenglow, went live on mainnet around 1:54 pm UTC on Wednesday, according to the Solana Foundation’s Alpenglow dashboard.Agave developer Anza said the time it takes a transaction to become final has now fallen from about 12.8 seconds to roughly 150 milliseconds. In the wake of the upgrade DeFi activity has been flat or fallen slightly — but it’s early days yet.The upgrade’s first phase, Votor, replaces the existing voting and finalization mechanism with direct validator voting and a certificate-based system, which is expected to result in the headline transaction count falling by around 60%. A later phase will introduce Rotor, a new block data-distribution protocol intended to replace Turbine.StarkNet votes to start work on becoming a post-quantum L1Starknet’s community has voted to support research into becoming an independent, post-quantum layer-1 blockchain.A governance vote that ran for seven days drew about 3,200 votes, with 93.52% of voting power in favor of the transition.The actual shift itself would require a separate, binding governance vote. For now, Starknet will continue operating as an Ethereum layer-2 network. “We’re beginning work on a whitepaper even before we start the weekend, and hope to release a draft for public scrutiny in November,” StarkWare CEO Eli Ben-Sasson told Cointelegraph. StarkNet saw the biggest fall of the top 100 coins this week, erasing one quarter of its value.Source: Made with Google AIUS senator probes Tether after reported deal with ex-Trump crypto adviserSenator Richard Blumenthal — the top Democrat on the Senate’s investigations subcommittee — has requested information from Tether CEO Paolo Ardoino after the Wall Street Journal reported the stablecoin firm had inked a $6.3 million deal with a marketing company co-founded by former White House crypto adviser Bo Hines.In a Thursday letter to Ardoino, the Connecticut lawmaker said that the Senate Permanent Subcommittee on Investigations demanded “records and information related to contracts, payments, communications, and lobbying” about the deal. The politician believes it may contravene rules around ethics, corruption and lobbying. Tether says an external investigation “found no evidence of wrongdoing.”Winners and LosersAt the end of the week, Bitcoin (BTC) is down 1.2% to trade at $80,549, Ethereum (ETH) is down 1.9% to trade at $2,343 and XRP (XRP) is up 0.9% to $1.20. The total market cap is at $2.68 trillion according to CoinMarketCap.Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are MemeCore (M) with a 24.4% gain, Venice Token (VVV) on 14.8%, and Ethena (ENA) on 14.1%.The top three altcoin losers of the week are Starknet (STRK) which was down 24.9%, Aerodrome Finance (AERO) down 12.5% and Sei (SEI) down 12.5%.Prediction of the WeekJPMorgan projects Bitcoin to outperform US stocks and gold over next decadeJPMorgan Asset Management projects Bitcoin (BTC) will outperform stocks and gold over the next decade, but cautions that its volatility makes it unsuitable for diversifying portfolios for now.On Monday, JPMorgan published its 2027 Long-Term Capital Market Assumptions report, projecting a 10% annualized return for Bitcoin, compared with 7.5% for large-cap US stocks and 5.5% for gold.“At the moment, we do not make a case for Bitcoin as a diversifier in portfolios due to its unstable market correlations,” the report said. “We see Bitcoin as a speculative asset and a hedge against monetary easing.”Top FUD of the WeekNew York AG seeks $1.37B from NovaTech founders over Ponzi schemeNew York Attorney General Letitia James has asked a court to order defunct crypto and forex trading platform NovaTech’s founders, Cynthia and Eddy Petion, and related companies to pay $1.37 billion over its Ponzi scheme.More than 11,000 New Yorkers lost tens of millions of dollars through NovaTech and an earlier crypto mining scheme, AWS Mining, the AG’s office said. The complaint alleged that promoters targeted Haitian and other immigrant communities through prayer groups, social media and WhatsApp, promising high returns and recruitment bonuses.Bitcoin Core changes security policy as AI makes bugs easier to findBitcoin Core is changing how it handles security vulnerabilities, due to how fast large language models can uncover software flaws. Bitcoin Core developer Antoine Poinsot said that in the past, vulnerabilities were generally kept under lengthy disclosure embargoes to give users time to upgrade before details became public.However, Poinsot said LLMs have made some flaws so easy to rediscover that delaying fixes offers little protection.“The embargo period achieves little but it delays the availability of a fixed release,” said Poinsot. “We are therefore updating our policy disclosure to accommodate those.”Pentagon bans US forces from using military info to bet in prediction marketsUS Defense Secretary Pete Hegseth has barred all Pentagon staff from using undisclosed information to place wagers on upcoming military action, including on prediction market platforms like Kalshi and Polymarket. In a memo sent to senior Pentagon and defense agencies on Tuesday, Hegseth said all Department of War personnel are prohibited from engaging in financial transactions using nonpublic information. This involves both classified and unclassified information. Top Magazine Features of the WeekHardware wallets aren’t the only way to protect your crypto, but from ETFs and passkeys to multisig accounts, each alternative has its own risks and trade-offs.The Animoca Brands chairman explains that AI agents can make trades while you sleep, but users need to plan for the day they lose access to the bots.

Čítaj viac

ECB official sees digital euro as key to protecting EU ‘sovereignty’

European Central Bank Executive Board member Piero Cipollone said the digital euro that is set for a pilot next year has the potential to give the bloc “sovereignty” over a payments infrastructure that currently requires dependency on external, non-European third parties.Cipollone said in an interview with Italy’s Milano Finance published by the central bank on Saturday that because the bloc is critically dependent on third parties, it’s not easy to ensure this smooth functioning. He did not cite specific third parties.“In recent years Europe has learned that, for some essential services, we cannot rely only on third parties. We saw this with energy and we’re seeing it today with defense. And the same is true for payments,” he said.The pilot will use real transactions by ECB and national central bank staff. With 36 market operators, including seven from Italy, collaborating on preparations, the ECB is inviting e-commerce and mobile-commerce operators to participate.“The smooth functioning of payment systems is one of our responsibilities. If we are critically dependent on third parties, it’s not easy to ensure this smooth functioning,” Cipollone said.To be sure, sovereignty doesn’t mean shutting third parties out, Cipollone said. “It means having the power to choose and knowing that, for an essential service like payments, Europe can also rely on its own strength.”In an April public lecture held in Latvia, Cipollone said that Europe’s reliance on non-European payment providers creates a strategic vulnerability. He said two-thirds of euro-area card transactions are governed by non-European companies, and that the digital euro could reduce that dependence and provide European-controlled payment infrastructure.The ECB Governing Council can only decide on issuing a digital euro only after legislative negotiations in Brussels conclude. “We hope that the regulation will be adopted by the end of the year, enabling the ECB’s Governing Council to issue a formal decision on issuance,” Cipollone told Milano Finance .Magazine: New DeepSeek ban in US, Swiss-Asia crypto ties deepen: Asia Express

Čítaj viac

Netanyahu floats use of blockchain as solution to potential financial sanctions

Blockchain has become an issue in this week’s Israeli elections after Prime Minister Benjamin Netanyahu said Friday that the country could turn to cryptocurrency to avoid strains on the economy from any potential international financial sanctions.He told a local television interviewer that Israel is exploring the use of blockchain technology and cryptocurrencies as a means of circumventing potential banking sanctions. “Blockchain is an alternative to sanctions,” the prime minister said in an interview with Israel’s Channel 10 economic network on Friday.His calling blockchain a “national strategic tool” signals a pivot in the government’s stance on the digital currency industry, from an investment event into part of the country’s economic defense strategy, reported CryptoJungle, Israel’s largest crypto media platform.A dozen Western countries have announced sanctions targeting goods from Israeli settlements in the West Bank in response to Jewish settler attacks on Palestinians and an increase in settlement construction approved by Netanyahu’s right-wing government. Those sanctions could extend into Israel proper, economists and industry figures told The Times of Israel last month.Several of the candidates seeking to replace Netanyahu in the Oct. 27 elections, as well as the head of the Bank of Israel, were quick to challenge the prime minister’s statement.“The BibiCoin vision is a threat to national security,” wrote Yashar party leader Gadi Eisenkot in a Saturday morning X post, using a play on Netanyahu’s nickname. The Bank of Israel in a statement rejected Netanyahu’s proposition, saying that cryptocurrencies “cannot be used as a route for bypassing sanctions.”Recommended: MoonPay buys crypto security firm Sodot in $100M push into institutional cryptoSharp reaction on the street and in the mediaAt Saturday evening’s anti-government rally in Tel Aviv, several onlookers weighed in on Netanyahu’s blockchain statement. “An economy that runs on the dark web makes us no better than our enemies,” said Aryeh Cohen, holding a sign that said in English “enough Bibi’s B.S.” Another rally attendee who gave only her first name, Pnina, told Cointelegraph “what’s next, the Bank of Israel living ‘neath the law.”Media critics also lambasted the idea of use of crypto to skirt sanctions.“The crypto element deserves particular scrutiny. Digital currencies can indeed move value outside some traditional banking channels,” wrote Yediot Ahronot columnist Nadav Eyal in an X post. “But they are not a substitute for a national financial system. They don’t provide credit lines to banks, they don’t replace international capital markets, and they don’t persuade foreign companies to violate sanctions that bar them from doing business with Israel.”“Crypto & blockchain-based solutions are not the tool for bypassing sanctions,” Ben Samocha, founder of CryptoJungle, told Cointelegraph on Sunday. “As demonstrated by the US Treasury against Iran, blockchain investigation allows tracking illicit funds, blocking their fiat gateway, and even freezing them.” He said that the Israeli economy is not fit to bypass sanctions using crypto.Magazine: Made an ‘honest’ mistake with crypto taxes? New bill offers way out

Čítaj viac
Načítava

Získaj BONUS 8 € v Bitcoinoch

nakup bitcoin z karty

Registrácia Binance

Burza Binance

Aktuálne kurzy