Hardware-wallet manufacturer Keystone identified unauthorized activity on its website on October 20, later classifying it as a security breach. The incident compromised customer names, phone and email contacts, delivery addresses, and order histories. Following an API activity review conducted alongside Shopify, the company verified the data exposure on October 23.
The compromised purchase records revealed specific items bought and total amounts paid. Although Keystone secured the affected access points, patched the security flaw, and initiated outreach to impacted buyers, the organization chose not to reveal the total number of individuals affected.
Customer records were exposed, not wallet credentials, Keystone says
Keystone emphasized that the breach left payment-card data, banking details, wallet passwords, seed phrases, and private keys untouched. The perpetrators only gained entry to commercial customer files, and no hardware wallet devices themselves were reported compromised.
“You trusted us with those details, and we’re sorry we didn’t keep them safe,” Keystone stated in an apology issued to its client base.
Red Flags: Shipping and order data could help scammers impersonate Keystone
The stolen logs supply bad actors with enough details to execute convincing impersonation scams. Keystone cautioned users that they might receive fraudulent telephone calls, text messages, emails, or postal mail presenting fake refunds, replacement hardware, or purported corrections to orders and shipping coordinates. Communications featuring a buyer’s actual name or purchase history can appear authentic even when fraudulent.
Mishaboar, a member of the Dogecoin community, cautioned that delivery data could also empower fraudsters to run targeted phishing campaigns. Purchasing a hardware wallet does not verify that an individual currently holds digital assets, but it does supply scammers with a tailored pretext for initiating contact.
Through a warning posted on X, Mishaboar advised users to refrain from disclosing personal or family details via social media channels. Referencing past security events involving Trezor and Ledger, he noted that criminals have also targeted victims through physical mail delivery.
Keystone advised users never to give out recovery phrases or private keys, never type a recovery phrase into an unverified device, and never click links embedded in unsolicited communications. The firm reiterated that it will never request a recovery seed or private key.
Keystone’s 180-day data-retention policy faces questions
Keystone maintains that it purges customer data 180 days following an order under normal circumstances. In the wake of the breach, multiple users on X challenged the validity of that policy.
The breach has drawn intense scrutiny regarding the duration for which the firm retains accessible shipping and purchasing archives.
Earlier incidents affected Trezor customer records and Ledger distribution
Earlier in the summer, a security failure at Trezor’s logistics partner ShipMonk leaked customer names, email addresses, phone contacts, shipping destinations, and purchase details. Trezor initially reported that over 13,000 U.S. buyers were impacted, though subsequent updates pushed that figure past 80,000, according to CryptoPotato.
In a separate occurrence earlier in October, Ledger reported a different variety of attack. Legitimate hardware units distributed via select Southeast Asian resellers were discovered to contain concealed internal hardware capable of capturing 24-word recovery phrases during initial configuration and broadcasting them across an LTE link. Ledger maintained that its Secure Element, operating system, and internal servers remained uncompromised, characterizing the event as a localized distribution-channel exploit. Initial estimates linked the altered devices to over $86 million in suspected cryptocurrency theft, though Ledger has not verified that amount.
Company begins customer outreach and investigation
Keystone is currently emailing impacted clients while the inquiry remains active. The business has pledged to release a comprehensive follow-up report, though no timeline was given.
FAQ
When did Keystone detect the website access and confirm the exposure?
Keystone stated it spotted the unauthorized entry on October 20, 2026. Following an API review with Shopify, the company verified on October 23 that customer shipping data had been accessed.
What customer information was exposed?
The compromised records included client names, contact channels, delivery locations, purchase histories, specific items acquired, and prices paid. Keystone confirmed that payment-card details, bank accounts, wallet passwords, recovery phrases, and private keys were not exposed.
What should customers do if a message offers a refund or replacement?
Keystone cautioned that fraudsters may leverage refund or replacement pitches to mimic the company. Buyers should steer clear of links in unexpected messages, stick to official communication channels, and refuse to disclose sensitive information.
What does Keystone’s 180-day deletion statement cover?
Keystone asserts that it deletes customer records 180 days after a transaction under normal conditions. Users on X challenged this claim following the disclosure of the security breach.
What happens after Keystone contacts affected customers?
The company indicated it is emailing impacted users and has launched an ongoing investigation. It promised a more thorough report later without providing a specific release date.
This article is for information only and is not financial advice.