Key Notes
- Keystone says customer names, contact details, shipping addresses and order records were exposed.
- The company says payment details, recovery phrases and private keys were not exposed.
- Affected customer counts and order dates remain undisclosed despite the public 180-day deletion promise.
Keystone has confirmed a breach of customer records at its official online store, exposing names, contact details, shipping addresses and order information. The hardware-wallet maker warned that criminals could use those details to impersonate its support team.
In an October 24 statement, Keystone said it detected unauthorized website access on October 20. It confirmed on October 23, after reviewing API activity with Shopify, that a third party had obtained customer shipping information.
View Keystone’s official statement
— Keystone (@KeystoneWallet) October 24, 2026
What the Breach Exposed
The compromised records include the products customers bought and their prices, alongside identifying and delivery information. Keystone said payment-card and bank details, recovery phrases, private keys and wallet passwords were not exposed.
The disclosure concerns customer information held by the official website. It does not establish that every direct buyer was affected, or that the hardware wallets themselves were compromised.
Keystone said it had blocked the unauthorized access, fixed the vulnerability and opened an investigation. It is emailing affected customers and plans to publish a detailed report. The statement did not disclose the number of affected people, the dates of the orders involved or the technical cause of the intrusion.
Its reference to checking API activity with Shopify does not identify a breach of Shopify’s wider platform. The assurances about excluded data and remediation are Keystone’s account of the incident.
Refunds and Replacement Devices as Scam Pretexts
The company warned that impostors could contact customers by phone, text, email or physical mail, offering refunds, replacement devices or supposed fixes to an order or address. Knowing a buyer’s name and exact purchase could make such messages appear more credible.
Keystone urged customers not to follow links in unexpected messages and to type keyst.one into their browser themselves. It said support would never request a recovery phrase or private keys, and warned users never to enter their recovery phrase into a device they had not ordered.
These are warnings about potential follow-up scams; the announcement did not quantify cryptocurrency losses resulting from this breach. CoinScreamer recently covered a separate Ledger phishing campaign exploiting security concerns. That coverage does not establish a connection between the attackers in the two cases.
The 180-Day Deletion Promise
Keystone’s public privacy page says shipping information is automatically deleted 180 days after an order is placed. It also offers deletion on request after delivery.
An older retention policy, updated February 22, 2023, describes automatic deletion when a customer has placed no new orders in the preceding 180 days. Its on-request process covers names, phone numbers, shipping addresses and email addresses, subject to delivery and outstanding-dispute conditions.
The differing wording leaves questions for Keystone’s promised report. Without the affected order dates or an explanation of which records were retained, the disclosure does not establish whether information older than 180 days was exposed or how the deletion policy operated in practice.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
