Digital Asset News covers the Keystone hardware wallet hack, Ripple's new bank charter, and Strategy pausing Bitcoin purchases
Rob from Digital Asset News covers three major stories: the Keystone hardware wallet security breach, Ripple receiving OCC approval for a national trust bank, and Strategy temporarily halting Bitcoin purchases.
Summary
Three major stories dominated the digital asset space this week: The Keystone hardware wallet company confirmed it will destroy nearly 19,000 devices after attackers stole the cryptographic authentication key used to verify device authenticity — a breach that also exposed close to 26,000 customer records and over 12,800 abandoned checkout records. Indian crypto exchange CoinDCX confirmed a $16 million loss from retired wallets, days after its CEO publicly dismissed breach reports as a false alarm — an example Rob highlights of executives lying directly to users. Ripple received final approval from the OCC (Office of the Comptroller of the Currency) for a federally supervised national trust bank, giving it a regulated platform to manage reserves for its stablecoin and provide digital asset custody to institutions. Strategy skipped Bitcoin purchases for the week, instead spending $205 million on preferred stock buybacks, reducing its cash balance by 46%.
During the Q&A, Rob performed a live demonstration of AI voice agent realism — playing an AI-generated conversation from The Block without disclosing it was AI, and finding that almost no viewers detected it — to illustrate how AI could dramatically scale social engineering attacks by simultaneously calling hundreds of thousands of people using stolen data such as that from the Keystone breach.
Key Takeaways
FULL TRANSCRIPT
Keystone Hardware Wallet Hack
Rob: I'd like to say congratulations to Keystone for not losing everybody's money — that was a really good thing they did. We'll talk about what's happening with Keystone as it was hacked. Also, Ripple is going to get a bank according to the OCC, and Strategy has stopped buying Bitcoin for now but is buying preferred stock.
There's a news report from Bitcoin News that lays it out like this: Keystone to destroy 18 — well, roughly 19,000 — hardware wallets after hackers steal device authentication key. Keystone has confirmed it will destroy 18,835 hardware wallets in existing inventory after attackers stole the cryptographic keys used to verify the authenticity of its devices.
Now, before we go on, I know I'm going to get a lot of pushback for calling this a hack. So let's go through the numbers. What is a hardware wallet hack? According to Ledger, it is any method that allows an unauthorized person to bypass a physical cryptocurrency storage device's offline protections and gain access to the private keys or recovery phrase inside. Looking at what was put out by Keystone and various publications, I asked Grok whether this would be considered a hack. The answer: yes, this is a hack. Attackers exploited a vulnerability in a third-party monitoring tool on Keystone's website, gained unauthorized access, and stole both customer data and the web authentication key used to verify device authenticity.
It gets even worse. The breach is concerning because the stolen key would allow attackers to manufacture counterfeit Keystone wallets that successfully pass the company's official authenticity checks, potentially putting users' Bitcoin at risk. The key is permanently embedded in existing devices and cannot be erased or replaced, forcing Keystone to destroy its remaining inventory, suspend shipments, and manufacture devices with a replacement key. That's a bummer, but they found it — and that's what's good.
Unfortunately, almost 26,000 customer records containing names, contact details, shipping addresses, and purchase information were stolen. And here's a nice little cherry on top for everybody who goes to websites, fills out information, but doesn't click order and thinks, "Ah, I'm protected." You're not. 12,873 abandoned checkout records containing potentially sensitive customer information were also compromised. So if you've ever gone to the Keystone website — and this applies to essentially every website — they retain your information as your checkout page gets abandoned. Have you ever gone to a website, put in some information, and then suddenly received an email saying, "Hey, did you forget something in your checkout? Come back and we'll have it all ready for you"? That's essentially what happens. They record everything. So if you went to the Keystone website and put in your information, it's already been stolen.
The thing is, we shouldn't take this purely as a negative, because the stress isn't the information itself or what comes at you — it's how we handle that information. I look at this and think to myself, all my information is on the dark web anyway, so let's just accept it and move on. It's a bummer, but it's going to keep happening.
Keystone also acknowledged that its automated data deletion system failed, leaving customer information stored beyond its stated retention period — I believe it was 180 days — and it was actually retained for two years.
Devices delivered before October 20th remain unaffected. Customers receiving devices with the old authentication key after that date are advised to seek additional verification. I would just say: why are you still using that wallet? Keystone has suspended shipments, begun notifying affected customers, and is moving production to a new authentication key.
Wouldn't it be a bummer if they just hadn't caught that and let everybody run amok and then started losing funds from their Bitcoin wallets? If I were a hacker — and I'm obviously not — I wouldn't collect everything over a couple of days, because I know they can shut things down or warn people. I think the smart move would be to let it go for years and just slowly drain hardware devices. Whatever you got over those years would be like being paid a dividend. I know that sounds cold and harsh, but that's pretty much how I think the smart hackers would do it. They wouldn't do it all at once because they know they can't. They would just do a slow bleed.
CoinDCX Data Breach Cover-Up
Good news — and also, watch what they do, not what they say, because there are liars everywhere. CoinDCX confirms a $16 million loss from retired wallets, days after the CEO called breach reports a false alarm. This isn't much in the grand scheme of things — in the quadrillions of dollars flowing throughout the world, $16 million is a pittance. But what concerns me is that people are people and they will lie right to your face, and this is an example. The Indian crypto exchange said user deposits piled up at old, vulnerable addresses that were compromised in its July 2025 hack after an automated system meant to move those funds out somehow stopped working.
I'm getting very concerned about some of the things going on in this space, and I think we need to figure out what the best options are for us, because these hacks are only going to get worse.
Custody Diversification Recommendations
That leads me to say: I hope everybody has a safe alternative. I use iTrustCapital — that works out pretty well. I use Tangem. I use Ledger. Bitcoin ETF — you can do that through Kraken. The reason I move things around is because crime is on the rise. It's not the protocols that get wiped out — it is the social engineering and the human factor.
I'm not perfect. Sometimes I drink too much, and when that happens I'm very vulnerable to an email, a call, or a text message. I might click on something stupidly and then lose my life savings. It doesn't have to be that way. Just move things around — just like we diversify our portfolio, sometimes you have to diversify your storage.
Even BlackRock and Michael Saylor do that. Strategy uses Coinbase Prime, Fidelity, and Fireblocks — all three — to custody their storage. Not only are you diversifying your storage, but you're diversifying the custody of that storage.
As a quick reminder, iTrustCapital just rolled out Q, which is AI trading. They back-tested it against four-year profiles. I signed up for the quantum alternative strategy — not my entire life savings, just a little bit to see how it does — and also the XRP strategy and Solana strategy. We'll see how it goes.
Ripple Receives OCC Approval for National Trust Bank
To get away from the negative for just a second — congratulations to Ripple and XRP. I don't talk about XRP too much; I'm just not a big XRP fan. That doesn't mean I don't think it could do great things. If you talk to someone from the XRP army for more than 60 seconds, you'll know they're pretty convinced.
Brad Garlinghouse says: "Big news heading into Ripple Swell. The US OCC — the Office of the Comptroller of the Currency — has granted final approval for Ripple National Trust Bank." That's significant. This gives Ripple a federally supervised platform to support Ripple USD and provide digital asset custody to enterprises and corporations.
Jack McDonald, Vice President of Stablecoins at Ripple, adds that this is much more than a charter. The Ripple National Trust Bank is designed to manage reserves supporting Ripple USD, serve as collateral trustee for stablecoin holders, and provide regulated digital asset custody — bringing federal banking supervision directly into the infrastructure that institutions use.
I personally signed up for that XRP strategy we mentioned. We'll see how it works out. People will say, "Rob, do you believe in XRP? Do you believe in how great it's going to do because it has great services and it's going to control the world and $589?" And I'm like, no, I don't. I believe in number-go-up technology. That's the tech I believe in. That's just the truth.
Strategy Pauses Bitcoin Purchases
Before we get into Q&A — Michael Saylor did great things with Strategy. Looks like they're going to skip Bitcoin purchases, as they did not buy anything last week, which is fine. They spent $205 million on preferred stock buybacks. It's a free market — do whatever you want. That means their cash balance has been reduced by 46%, down to $242 million. For that preferred dividend stock, they'd like it to stay around $100. There have been some cases where it dipped below — around $97 — and there were some troublesome times over six months, but on a daily basis it just keeps going along. Good for them.
Community Price Predictions
I want to give a shout out to everybody who watches the show — you are beating essentially all of the so-called experts in price predictions. I started a website called Price Profits. When you click on it, you can see some of these predictions. Standard Chartered thinks we're going to be at $100K. Arthur Hayes says $125K. Bernstein has $150K to $200K end of year. Bitwise goes even higher. But if you go to the community submissions, I'm actually quite impressed because a lot of you are pretty close — almost on the dot.
Scott McCalpin predicted $75K by January 2027. If everything holds true, he'll be right. Blockhead predicted $71K by December — could happen. Marty said $80K — right on if it holds. And Echol Lee said $69K by October 2026. I'll be damned — I think Echol Lee nailed it. I wouldn't be surprised if we fall a little bit, and she's probably the closest. Congratulations everybody.
Q&A
Rob: Tony is right — nobody cares about the tech. I mean, I care about the tech. The number-go-up part. Look, the thesis for Bitcoin has always been the same. As long as governments keep printing money — and not just our government. We're really good at printing money in America. We're good at two things: diabetes and printing money. But all the other countries in the world do the same thing. So as other countries keep debasing their currency, I will continue to buy Bitcoin every single Monday using Benjamin Cowen's risk levels from Into the Cryptoverse, and it's worked out pretty well. The strength is in the scarcity and you can verify it. The happiest I've been with Bitcoin is when I've used it as it was originally intended in the white paper — peer-to-peer transactions. As I do that, it makes me realize just how great it can be.
Roger asks: "Are you long on diabetes?" Thankfully my A1C level is relatively low, so I'm okay. But if it wasn't for diabetes, would the pharmaceutical industry really make that much money? I'm not going to go down that tangent.
Emry asks: "It's scary — Anthropic's Claude coding is powerful. Is it possible to get hacked? Seed phrases?" Not with them, not right now at present. But if you listen to everybody, at some point Bitcoin will be hacked and so on. If Bitcoin gets hacked, forget the quantum computing angle — I don't really believe that's going to make it. The AI part I can definitely see, especially as we see the advances moving forward. The big thing is: if you're North Korea or Russia and you want to bring down the world powers and collapse the economic system, are you going to go for a market cap of $1.6 trillion — whatever Bitcoin is right now — or are you going to go after the Federal Reserve, the banks, the custody services, and start to wipe them out? Which one would you really do? I think we've got bigger problems than that. Also, if there's some type of virus or bug inserted into the electrical grid, I worry more about that than losing some Bitcoin.
"Show me a man who claims to be honest and I'll show you a liar." — Marcus Aurelius. We're all liars. Every single one of us. We try to do the right thing, but sometimes you've got to lie. Yesterday I lied through my teeth to everybody. If you were watching yesterday's show, there was a back-and-forth from The Block, and I told everybody it was Jack Dorsey's company — he's a big Bitcoin believer — and that he had created some new integration between AI and Bitcoin. I had you just listen to two of what sounded like top developers talking amongst themselves, and then my internet gave out. I said, "Sorry, I just lied to you." The reason I lied was because that was actually an AI voice agent that The Block just rolled out — I think it was called Dorsey or DC Stacy or something like that — and it sounded so real, just like a real person. The reason I didn't tell you upfront was because I wanted you not to have any precognitions about what I was about to play. Not one of you — well, maybe one person — said they could tell. It just sounded exactly like a real person.
The point I was getting to is that the only bottleneck for hackers right now is the number of human hackers available. For them to call you and say, "Hey, this is Jimmy calling from Kraken and we've got a big problem" — out of a hundred people they call, they get two to fall for it. That's a great day for a hacker. They just made tens of thousands, maybe hundreds of thousands of dollars.
The big problem will be when AI rolls in. Take every single person from that Keystone hack — all that released data — and have the AI filter by zip code, find the ones in affluent neighborhoods, and then have an AI agent call every single person simultaneously. Over VoIP, I'm sure you could do it. They could do it every day at 5:00 PM — 250,000 people, just like that. How much richer would they be?
Erica asks: "Are you and your better half investing in more real estate or leaning more into crypto? I see real estate prices are dropping." They're looking pretty good, I must say. Properties in Florida — if you're a buyer, those are looking great. If you're a seller, it's a disaster. As real estate prices drop precipitously, and then we look at what's going on with AI — did you see that story about Microsoft offering buyout packages to 60,000 of their employees? Essentially saying, "We're going to give you some money, but get out." I've received one of those from a company I worked for before. They said, "Rob, we really like you, but we're going to trim some fat and you're fat, so get out of here." Maybe there is a bubble coming. Who knows?
As long as the government keeps doing what they're doing, I'll keep buying Bitcoin. I think we're in the right place at the right time. And what do you do in the bear market? You buy. Because that's what you do in the bear market. And you sell in the bull.