Breaches & scams

A hardware-wallet company was breached. What should you check?

By Jolly Ledger editorial · Published 27 October 2026 · Reviewed 27 October 2026 · 4 min read

Short answer

First identify which system was affected and whether your device, purchase or actions fall within the stated scope. A vendor breach does not automatically mean your wallet keys were stolen, but some incidents require specific verification or urgent official guidance.

A headline saying a hardware-wallet company was breached leaves out the detail you need most: what was breached? A mailing list, a companion app and a manufacturing authentication system create very different problems. Start by naming the affected system rather than treating the company’s name as a diagnosis of your own wallet.

Find the current notice yourself

Open the vendor’s official site from a bookmark or an address you typed and checked. Find the original notice and its latest dated update. Do not use a security alert’s button, attachment or phone number as your route to verification. Note the update date and the stated scope — early findings often change.

Look for affected purchase periods, models, software versions, delivery dates and sales channels. A notice about one distributor or newsletter provider may not apply to everyone using the brand. Not being notified is not proof you are outside the scope; compare your own records with the published criteria.

Sort the incident before choosing an action

Reported exposure	What to establish	What not to assume
Customer or newsletter data	Which personal details and records were affected	That contact information includes wallet keys
App or download infrastructure	Whether your installed version or download was affected	That every official-looking installer is trustworthy
Firmware or update process	Exact models, versions and official remediation	That an unsolicited update repairs the problem
Hardware or authenticity system	Delivery scope and any extra verification required	That a passing check settles every supply-chain concern
Recovery phrase or private key	What secret was exposed and how	That a new PIN makes an exposed backup secret again

These categories can overlap. Keystone’s October 2026 statement, for example, describes both customer information and an authentication key — see our Keystone explainer. Each affected system needs its own answer, and authenticity checks have limits.

Record what you actually did

Receiving an alert, opening a page, installing software, approving a transaction and revealing recovery words are different events. Write a short timeline using non-secret details: the device model and software version, but never your backup, PIN or passphrase. This helps official support address the real exposure.

A free first-response checklist

Stop interacting with the suspicious message or tool.
Keep messages and a non-secret account of your actions.
Read the vendor’s latest official scope and instructions.
Review familiar account history without using links supplied by the sender.
If secrets were disclosed or an unfamiliar action approved, seek urgent official, device-specific guidance.
Do not reset the device or start an improvised transfer to satisfy an alert.

Know what your checks cannot prove

An unchanged balance is a useful observation, not proof nobody copied a secret. A suspicious email is evidence of targeting, not proof of key theft. Keep those boundaries clear when deciding whether you need privacy precautions, software remediation or a response to an established credential exposure.

Use the vendor’s own instructions for operational steps; another maker’s procedure may not fit your device. For more, separate customer data from wallet keys and review what happened after a phishing click.

Sources

Identify phishing scams — BitBoxDistinguishes receiving, clicking, installing, approving and revealing wallet secrets; operational steps are BitBox-specific.
Statement Regarding the Security Incident on Our Official Website and Customer Guidance — KeystoneExample of dated, device-specific authenticity guidance.

Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.

Turn this into a preparation plan

Answer 16 calm questions about your setup. Get findings, scenario walkthroughs and a family briefing — on your own device, no account, no wallet connection, no recovery words.

Start your free checkupThe full preparation pack is free during launch beta. Planned one-time price: €39.