Threat Intelligence Brief
Curated summary with source attribution
Source: tradingview.com
Threat Risk: High
Victim: Keystone and hardware wallet users
Incident: Website breach via third-party tool leading to customer data theft and authentication key compromise.
Impact: Potential distribution of spoofed hardware wallets capable of stealing user assets.
Attacker: Unidentified threat actors
Analysis: The attacker leveraged a vulnerability in a third-party monitoring tool to gain elevated privileges on Keystone’s website. This breach resulted in the theft of nearly 26,000 buyer records and a critical device authentication key. The loss of this key creates a significant supply chain risk, allowing bad actors to produce counterfeit hardware that passes genuine authenticity checks.
Recommendations: Verify the authenticity of any Keystone device purchased after October 20 via official support channels.; Audit third-party monitoring tools and integrations for potential privilege escalation vulnerabilities.; Implement and verify the execution of automated data retention and erasure policies to minimize leak impact.
Source: TradingView/Cointelegraph
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source