A hardware wallet exists to keep keys away from the people who should not have them. This week’s news says it does not keep anyone away from your home. Keystone, a hardware wallet maker, has confirmed that an unauthorised third party obtained its customers’ shipping data: names, contacts, addresses, order details with items and prices. Not keys, not seeds, not payment data. Only the part you need in order to knock on the right door.

What happened

The unauthorised access to the site was detected on 20 October; the confirmation, after verifying API activity with Shopify, came on 23 October. The company says it blocked the access, fixed the vulnerability, opened an investigation and started emailing customers. It did not say how many people are involved, nor how the intrusion happened, and it promised a detailed report.

The uncomfortable point is retention. The official documentation speaks of deleting shipping data 180 days after the order, yet several customers received the notice for purchases made more than two years earlier, and the support page admits that city and country are not removed. A written policy and an applied policy are two different things, and here the difference is measured in real addresses.

The risk that is not in the cryptography

The second data point comes from CertiK: in the first half of 2026, 52 “wrench attacks” were verified — physical assaults to force the victim to transfer crypto — with a 33.3% rise on the 39 of the same period in 2025 and a recorded exposure of 124.1 million dollars. Home invasions go from one case to twenty and become the main technique; 39 of the 52 episodes are in Europe, 33 in France. These are numbers that have nothing to do with software: they concern the person who knows the password.

The market, meanwhile, is slowing

Bitcoin spent the weekend around 80,000 dollars, its lowest level since mid-September, after a fall of roughly 2,000 dollars and in a mood weighed down by oil and expectations on rates. Over the same weekend Hong Kong moved its retail stablecoin: HSBC launched RedCoin for the 3.3 million PayMe users, while Anchorpoint — a joint venture between Standard Chartered, Animoca Brands and HKT — chose caution. CEO Dominic Maffei did not confirm retail by the end of 2026: “building the market in a sustainable way over the long term” counts for more than haste, and rushing “makes no sense”.

Two speeds living side by side: a regulated infrastructure advancing with caution and a physical risk that does not wait for the rules. The most robust portfolio of 2026, reading these chronicles, belongs to whoever never let it be known where they live.

Verified sources: ForkLog, CoinCentral, BlockchainReporter and Cointelegraph on the Keystone breach (24-25 October 2026); CertiK, Intel3D H1 2026 Wrench Attacks Report (22 July 2026); CoinDesk, CertiK statement (22 July 2026); Cointelegraph and SCMP on Anchorpoint (25-26 October 2026); TokenPost and crypto.news on RedCoin and HKMA licences (26 October 2026); Investing.com/Yahoo Finance and StatMuse on the price of Bitcoin (26 October 2026). Excluded for single sourcing: Utexo’s public launch of USDT on Bitcoin and Strive’s mention of further purchases.