After a security breach exposed customer shipping details and purchase records, cryptocurrency hardware wallet manufacturer Keystone issued an apology. On October 20, 2026, the company discovered illegal access to its official website.

Three days later, after reviewing API activity with Shopify, the company verified that a third party had stolen client data. Because hardware wallet customers' shipping addresses can be used to identify potential cryptocurrency owners, the incident caused concerns about their privacy.

Keystone Confirms Customer Information Was Exposed

On October 24, Keystone made the issue public through their official X account, admitting that consumer data had not been sufficiently protected. Names, contact information, shipping addresses, and order details, including the goods bought and their pricing, were among the exposed records, according to the company.

The timeline indicates that it took three days to confirm the data exposure after discovering illegal access. Before determining that a third party had acquired the data, Keystone claimed to have examined API activity with Shopify.

The company has blocked the unauthorised access, fixed the vulnerability and opened an investigation. It has also begun emailing affected customers and promised to publish a detailed incident report.

However, Keystone has not disclosed the total number of affected customers or explained the precise technical method used to access the records. The company said its investigation was continuing, leaving questions about the full scope of the incident unanswered.

Shipping Addresses Leaked but Wallet Credentials Remain Unaffected

According to Keystone, the incident did not reveal payment card numbers, bank account information, recovery phrases, private keys, or wallet passwords. Instead of the cryptographic credentials needed to access bitcoin wallets, the confirmed disclosure involves customer data stored by its online store.

This distinction is important because scammers may still find value in the exposed information. Criminals can craft convincing communications that appear to come from Keystone or another trusted provider by using names, phone numbers, email addresses, delivery addresses, and purchase histories.

A scammer who knows which hardware wallet someone purchased could claim that the device needs a replacement, security update or refund. An exposed home address also creates a potential physical security concern for cryptocurrency holders.

The incident has prompted additional scrutiny because some customers reportedly received notifications about older purchases despite Keystone previously promoting a policy of deleting shipping information within 180 days. The company has not publicly clarified why some customers say records from much older orders were involved. These reports raise questions about data retention, although the precise circumstances remain under investigation.

We owe you an apology.

On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.

Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.

We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.

Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.

NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type https://t.co/7km8AZM288 yourself.

A detailed report is coming soon.

Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance.

Again, we're truly sorry to everyone affected.

— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026

Keystone Warns Customers About Targeted Phishing Scams

Keystone has warned that attackers may impersonate the company through phone calls, text messages, emails or physical mail. Potential scams could involve promises of refunds, replacement devices or assistance correcting an order or shipping address.

The company has specifically instructed customers never to disclose their recovery phrases or private keys. It also warned users against entering recovery phrases into devices they did not order and advised them not to click links in unexpected messages.

Consumers should visit Keystone's official website on their own instead of clicking on links provided by someone posing as the company. The official email address, support@keyst.one, which Keystone supplied in its introduction, can be used by anyone who receives suspicious communications to get in touch for assistance.

These safety measures are especially important when a message contains correct transaction information. Finding out a customer's name, delivery address, or device model does not prove the sender's legitimacy. Genuine leaked information might be used by criminals to make fake requests seem legitimate.

Additionally, customers should be cautious of unforeseen requests to transfer money, install new software, or confirm wallet ownership. According to Keystone, users will never be requested to share their private keys or recovery phrases.

Keystone Joins a Wider Wave of Hardware Wallet Data Breaches

The Keystone issue comes after Ledger, Trezor, and SafePal were among the cryptocurrency hardware wallet firms that leaked customer information in 2026. Customers who trusted wallet providers and their service partners with personal information were impacted by the exposure of shipping data, contact information, and purchase records in these circumstances, according to reports.

While SafePal revealed a vulnerability in an order tracking system that exposed customer information, Trezor revealed instances affecting its shipping partner ShipMonk. Additionally, Ledger disclosed a different incident affecting client data that was managed by its commerce partner. Since the events' stated circumstances vary, they shouldn't be interpreted as proof of a single, common attack.

Another case where data related to hardware wallet purchases was made available to an unauthorised person is added by Keystone's disclosure. To determine how the attacker obtained access or whether the event involved compromised credentials, excessive API permissions, or another vulnerability, the organisation has not yet disclosed adequate technical information.

The promised investigation report will be crucial in clarifying the attack technique, the number of impacted clients, and the actions taken to avoid future exposure. Customers should exercise extra caution when responding to unexpected emails about their Keystone purchases until such facts are available.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Ledger Wallet Spy Implant Triggers Karpelès Feud
2. Unagi Assets for Sale After Court Ordered Liquidation
3. Jio’s $106B IPO Hits Bitget With 20x Pre-IPO Perps
4. South Korea Blocks 27 Unregistered Crypto Exchanges
5. 95% of India’s Crypto Offshore, ₹57,147 Crore Lost?

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.