Keystone breach: customer names, shipping addresses and order details taken from wallet maker's website
Keystone said on October 24, 2026 that a third party obtained customer names, contact details, shipping addresses and order details from its official website, and that payment details, recovery phrases, private keys and wallet passwords were not involved.
What happened
Keystone, the maker of air-gapped hardware wallets that people use to hold cryptocurrency keys offline, said in a post on X on October 24, 2026 that it detected unauthorized access to its official website on October 20. The access was to the website and its store, not to the wallet devices themselves. After verifying API activity with Shopify, the e-commerce provider behind its store, the company confirmed on October 23 that a third party had obtained customer shipping information, and it apologised to customers in the post. Keystone says it has blocked the access, fixed the vulnerability, opened an investigation and is emailing affected customers, and that it plans to publish a detailed report in the coming days. The company has not said how the attacker got in, how many customers are affected, or which order dates the taken data covers.
Who is affected
People who bought from Keystone’s official website store. Keystone is a Hong Kong-based brand that sells its wallets to customers internationally through that store. The data the third party obtained covers names, contact details, shipping addresses and order details — the items purchased and the prices paid, which together show which wallet a customer owns and where it was delivered. Keystone says payment card and bank details were not compromised, and neither were the things that control a wallet itself: recovery phrases, private keys and wallet passwords were not involved. The company has not disclosed a number of affected customers, so anyone who ordered from the store should treat the notice as applying to them until Keystone’s email or its promised report says otherwise.
How serious
The concrete risk is targeted impersonation scams. The taken records pair a person’s name and home address with proof that they own a hardware wallet and a record of what they bought — exactly what a scammer needs to pose as Keystone support offering a refund, a replacement device, or a fix for an order or a shipping address, by phone, text, email or mail. Those are the approaches Keystone itself warns are coming. The end goal of that scam is the recovery phrase: the phrase was not taken in this breach, but a customer talked into revealing it, or into typing it into a device they did not order, hands over control of the wallet. A scammer who can quote a real order — the real item, the real price and the real delivery address — sounds far more convincing than a generic phishing message, and the risk does not expire the way a leaked password can be changed away: a name, an address and a purchase record stay true for years. A home address tied to a wallet purchase also carries a targeting risk that an ordinary email-address leak does not. The data on its own does not empty a wallet — the keys stay on the device, not on the website.
What to do now
If you bought from Keystone’s website, read the company’s email, but verify anything it asks you to do through official channels you open yourself rather than links in a message. Never disclose your recovery phrase or private keys to anyone — Keystone says it never asks for them, and no refund, replacement or address fix ever requires them. Do not enter a recovery phrase into a replacement device you did not order, and treat a device or a letter that arrives unexpectedly as suspect too. Treat unexpected contact about refunds, replacement devices, order problems or address corrections as unproven, whichever channel it arrives by — phone, text, email or mail — and go to Keystone’s official site directly for order or support questions.
Sources: Crypto Briefing · CoinLab · CryptoNews