Keystone Breach Exposed Customer Data the Wallet Maker Pledged to Delete

Hardware wallet maker Keystone has confirmed that an unidentified third party obtained sensitive customer information from its Shopify-powered online store, including names, contact details, shipping addresses and full order details — and several customers say the exposed data should have been deleted months or even years earlier under the company's own retention policy.

In a post on X at 1:59 p.m. ET on Saturday, Keystone said it detected unauthorized access to its official website on Oct. 20. Three days later, after verifying API activity with Shopify, the company confirmed the breach. "You trusted us with those details, and we're sorry we didn't keep them safe," Keystone wrote.

The company said the attacker did not get payment cards, bank details, recovery phrases, private keys or wallet passwords. It has not said how many customers were affected, how the attacker got in, or whether it has identified or communicated with the intruder.

"We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers," Keystone said. When users on X asked about the scope of the breach, the firm replied that it is "still conducting a thorough investigation" and promised a detailed report in the coming days.

What did Keystone promise about data deletion?

The company has pitched its data retention policy as a competitive selling point for months. On Jan. 5 — the same day Ledger customers were notified of a similar leak at that manufacturer's e-commerce partner Global-e — Keystone posted on X: "180 days after your order, your shipping data is permanently deleted."

A March post went further: "Other hardware wallets keep your data forever. We delete your shipping info in 180 days max." Posts from August repeated the claim.

Keystone's Privacy Promise page states that "all shipping information is automatically deleted 180 days after your order is placed." The wording differs in the formal privacy policy, last updated in May 2021, which says Keystone erases "all order information of each customer who has not made an order within the last 180 days."

A help center article on deletion requests adds two caveats: records of a customer's city and country are not deleted, and "the final deletion process is handled by Shopify." That detail matters, because the breach ran through Shopify's platform, and it leaves open the question of whether Keystone ever actually controlled the deletion pipeline it marketed.

What are customers reporting?

Several customers say their data was exposed despite exceeding the 180-day window. "I bought it over two years ago. I received an email notification," X user @trintaetres_33 wrote on Saturday. Another user, @BlockchainBarmy, said 214 days had passed between their last order and the breach.

One user flagged a possible compromise before Keystone disclosed anything. In a Friday evening post, @PEPE_Whale69 said a caller spoofing a Montreal police number tried to social-engineer them, at one point asking whether Amazon, eBay or Keystone "meant anything" to them. The caller had details matching a Keystone order the user placed in 2024 — well before the claimed deletion period.

Keystone's X account replied at 1:08 a.m. ET on Saturday that it had "initiated an urgent investigation into this matter." The company says it confirmed the breach on Oct. 23.

The Block could not independently verify the users' claims, and Keystone has not publicly answered questions about whether it followed the 180-day policy. The Block has also reached out to Keystone and to the X users for comment.

How does this fit the wider hardware wallet breach wave?

Keystone is the latest hardware wallet maker to disclose a customer data leak this year, and the pattern is escalating:

• In August, Trezor said a breach at shipping partner ShipMonk exposed personal data of nearly 14,000 customers. It later said the incident affected about 67,000 more U.S. customers, and that ShipMonk had given written assurances the data was deleted when it was not.
• Days after Trezor's first disclosure, SafePal said a flaw in its order-tracking system exposed personal information of nearly 40,000 customers.
• Earlier this month, Ledger confirmed that devices sold by reseller CryptoBilis contained hardware implants that capture recovery phrases during setup. On-chain researchers estimated losses at more than $86 million.

Keystone has warned customers that scammers may pose as the company by phone, text, email or mail, offering refunds, replacement devices or order "fixes." It told users never to enter a recovery phrase into a device they did not order and to avoid links in messages claiming to come from Keystone.

The operational stakes are clear: a hardware wallet's value proposition rests on operational security, and shipping-data leaks enable precisely the targeted social engineering that Keystone is now warning about. The company's promised detailed report, due in the coming days, will need to answer whether the 180-day deletion pledge was ever enforced — and if not, why.