Keystone confirms breach exposing customer order data

What happened

Keystone, a manufacturer of hardware wallets, has confirmed that an unauthorised party reached customer records through its website, obtaining names, contact information, shipping addresses and details of what buyers ordered. In a statement posted on X on Saturday, the company said recovery phrases, private keys, payment card numbers and bank account details were not part of the exposure.

According to the company's account, suspicious activity on the site was noticed on 20 October. Keystone then reviewed application programming interface activity connected to Shopify, the e-commerce platform behind its store, and by 23 October had established that a third party had taken customer names, contact information, delivery addresses and purchase records. The intrusion was blocked, the flaw that allowed it was patched, and affected buyers began receiving email notifications. Bitcoin.com News reported that the disclosure was posted at 1:59 p.m. ET on Saturday.

Keystone has not said how many customers are affected, which historical orders are involved, how long unauthorised access remained possible, or how the entry was achieved. It said a fuller incident report would follow but gave no publication date. Blockonomi reported that no tally of affected transactions accompanied the disclosure.

The company warned buyers to expect fraudulent refund offers, fake replacement-device schemes and messages offering help with an order, which may arrive by email, phone call or text. Keystone said it never asks for recovery phrases or private keys and advised customers to verify communications through its official channels rather than following links in unexpected messages. Bitcoin.com News noted that one X user, posting as OG Degen, had described a call from a spoofed Montreal police number involving an attempt at social engineering a day before Keystone confirmed the breach.

Why it matters

Hardware wallets exist so that keys never touch an internet-connected machine, and nothing in this incident suggests that design failed. The records that leaked sit in an online shop, and they connect a named person at a specific address to the purchase of a device used to hold crypto. That combination is what makes impersonation credible: someone who already knows the order number, the product and the delivery address has a far easier time posing as the vendor. The danger is less a remote drain of a wallet than a persuasive approach that convinces an owner to part with a seed phrase, or to set up a "replacement" device that arrives already configured. Keystone's own warnings point at exactly those tactics.

What the data shows

Known exposed fields: names, contact information, shipping addresses, purchased products and prices. What Keystone says was not exposed: recovery phrases, private keys, wallet passwords, payment card numbers and bank account details. What remains undisclosed: a customer count, the affected purchase dates, the length of the exposure window, and any attribution or technical explanation of the intrusion. For scale, SafePal's figure was 39,798 customers and Trezor's addition was about 67,000 US customers; Keystone has published no equivalent number. Its wallets sign transactions offline and communicate by QR code, which limits direct connections to internet-enabled devices.

Background

The breach places Keystone in a run of hardware wallet vendors handling data problems during 2026. In August, Trezor disclosed an incident at shipping provider ShipMonk and later put the number of additional affected US customers at roughly 67,000. SafePal reported an authorisation flaw in its order-tracking system affecting 39,798 customers. Coldcard dealt with a weakness in seed-generation randomness and substantial estimated losses, while Ledger has been responding to reports of tampered devices distributed through a reseller, with new details published on 13 October. In most of the data cases, the exposed material sat in ordering or fulfilment systems rather than in the signing hardware, and the practical consequence was phishing rather than key theft.

What to watch

Two developments are worth tracking. The first is whether Keystone delivers the fuller incident report it has promised, and whether that document supplies the customer count, exposure window and access method left out of the initial statement. The second is whether the stolen records turn up in targeted phishing or extortion attempts against buyers, which would indicate how widely the data has spread. Keystone says affected customers are being contacted by email; anyone receiving refund, replacement or order-support messages should confirm them independently rather than acting on the message itself.

Questions readers ask