BTC $80,283 
ETH $2,323 
USDT $0.9994 
BNB $740.61 
XRP $1.30 
USDC $0.9999 
SOL $101.55 
TRX $0.3309 
FIGR_HELOC $1.06 
ZEC $1,237 Hacks & Security · Explained
Keystone hardware wallet breach exposes customer shipping data
The crypto wallet maker confirmed attackers accessed customer names, addresses and order details through its website.
Key takeaways
- Physical threat risk. Security researchers highlighted that leaked shipping addresses pose a greater danger than phishing, as attackers could use them to locate and physically assault crypto holders. Such crimes, known as wrench attacks, have increased 33%
- Data retention questions. Keystone claimed in 2023 to delete customer shipping data after 180 days, yet some customers reported receiving breach notices for purchases made over two years prior, raising questions about what information the company actually retained.
- Sector-wide problem. The Keystone breach follows recent security incidents affecting other major hardware wallet manufacturers, including Ledger and Trezor, indicating ongoing security challenges across the industry.
What happened
Keystone, a crypto hardware wallet manufacturer, disclosed a website security breach that exposed customer shipping information to unauthorized attackers. The company detected suspicious activity on October 20 and confirmed the breach on October 23 after reviewing API activity with Shopify, the e-commerce platform powering its store. Keystone announced the incident on October 24 through a post on X, apologizing to affected users.
The exposed data included customer names, contact details, shipping addresses and order information such as items purchased and prices paid. Keystone stated that payment card details, bank information, recovery phrases, private keys and wallet passwords were not compromised. The company said it has blocked the attacker's access, fixed the underlying vulnerability, launched an investigation and begun notifying affected customers by email. However, Keystone did not disclose how many customers were impacted or provide details about how the attacker gained initial access.
The timing and scope of the breach raised additional concerns. Some customers reported receiving breach notifications despite making purchases more than two years earlier, contradicting Keystone's previously stated data retention policy. Cointelegraph reported that the company did not respond to questions about how older customer records were exposed or how many users were affected by the time of publication.
Why it matters
The breach poses significant risks beyond typical data leaks. Security researcher Taylor Monahan emphasized that leaked shipping addresses create vulnerability to physical attacks and kidnappings, not just phishing scams. These crimes, commonly called wrench attacks, involve using threats or violence to force cryptocurrency holders to surrender their assets. Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, representing a 33 percent increase from 39 cases during the same period in 2025. The exposure of home addresses for hardware wallet owners creates a direct attack vector for criminals seeking to exploit this escalating threat pattern.
What the data shows
The breach affected customer shipping records accessible through Keystone's official website. An X user identified as OG DEGEN reported receiving a phone call from someone claiming to be law enforcement investigating a fraud case, with the caller referencing personal details from a Keystone order placed in 2024. The user suspected the attacker was attempting to convince them their private keys had been exposed and planned to send a phishing link. Another X user, trintaetres, reported receiving a breach notification despite purchasing their device more than two years prior, suggesting the exposure may have included older order records not aligned with Keystone's stated retention policy.
Background
In January 2026, Keystone announced via X that it had adopted a 180-day customer data retention policy, automatically deleting shipping information after that period. The company's Privacy Promises page stated that shipping details are removed automatically 180 days after an order is placed, with options for buyers to request deletion sooner. This policy appeared designed to address industry security concerns following breaches at competing hardware wallet manufacturers.
The Keystone breach follows a pattern of security incidents affecting the hardware wallet sector. Ledger experienced a supply chain attack worth over 100 million dollars, while Coldcard suffered a 116 million dollar exploit. Trezor disclosed a data breach in August 2026. These incidents have raised broader questions about the security practices of major wallet manufacturers and whether hardware wallets can adequately protect user information.
What is still unclear
Keystone has not disclosed the total number of customers affected by the breach. The company also has not explained the specific method used to gain unauthorized access to its website or clarified the full date range of orders involved. Additionally, it remains unclear how customer data from purchases made more than 180 days before the breach could have been exposed if the company's retention policy was functioning as described. Keystone announced that a detailed breach report would be published soon.
Questions readers ask
What information was exposed in the Keystone breach?
Customer names, contact details, shipping addresses and order information including items purchased and prices were exposed. Payment cards, bank details, recovery phrases, private keys and wallet passwords were not compromised.
When did Keystone discover the breach?
Keystone detected suspicious activity on October 20 and confirmed unauthorized access on October 23 after reviewing API activity with Shopify.
Why is leaked shipping address data particularly dangerous?
Security researchers warn that shipping addresses enable physical attacks and kidnappings, known as wrench attacks, where attackers use violence or threats to force cryptocurrency holders to surrender their assets. This poses a greater risk than phishing scams.
