Keystone discloses breach exposing wallet buyers’ data

Keystone disclosed on Saturday that an unauthorized third party accessed customer shipping and order data after the crypto hardware-wallet maker detected suspicious website activity earlier in the week. The company said it confirmed the intrusion on Friday after reviewing API activity with Shopify, but it did not disclose how many customers the breach affected.

The exposed fields included names, contact details, shipping addresses and other order details, including the items bought. The disclosed material concerns customer information; Keystone did not report that attackers obtained private keys. The company also withheld the attack vector and the full affected population.

“We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” Keystone said. “Again, we’re truly sorry to everyone affected,” the company added. Those steps address continuing access and notification, while leaving the investigation to determine the breach’s full scope and cause.

Keystone warned that the exposed information could support targeted phishing attacks. Security researcher Taylor Monahan also warned that leaked shipping addresses could expose cryptocurrency holders to physical attacks and kidnappings. The company’s disclosure identifies risks involving customer contact details, order history and physical location, not merely online account access.

Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 during the same period in 2025. A wrench attack uses physical threats or violence to force cryptocurrency holders to surrender their assets. The reported cases established no link to Keystone, but the tally shows why an order breach can create physical-security concerns as well as online fraud risks.

Why are breach notices reaching two-year-old customers?

In a 2023 blog post, Keystone said it had reduced its customer-data retention period to 180 days following security incidents affecting other hardware-wallet manufacturers. Yet some customers said they received breach notifications even though they bought their devices more than two years ago, raising questions about what information the company retained and whether it deleted records outside the stated period.

Two social-media accounts described the issue:

• The X account “OG DEGEN” said a scammer called, claimed to be law enforcement investigating a fraud case and referenced personal information from a Keystone order placed in 2024. The user suspected the caller obtained that information through the breach and planned to claim the buyer’s private keys had been exposed, then send a phishing link to reset them.
• Another X user, “trintaetres,” said the email notification also reached them despite a device purchase more than two years earlier.

Cointelegraph asked Keystone how customer information tied to purchases older than 180 days could have remained accessible and how many people the incident affected. The company had not responded by publication time.

What does this change for hardware wallet buyers?

It changes the threat model for hardware-wallet buyers: exposed names, contact details, shipping addresses and purchase histories can help an attacker make a fraudulent approach appear tied to a genuine transaction. The incident does not establish that attackers obtained private keys. It does show how scammers can combine accurate order information with a false claim of key exposure to direct a victim to a phishing link.

Keystone’s retention issue extends the concern to former customers. Buyers cannot assume that the 180-day policy eliminated every order record, and the company has not explained the discrepancy. For anyone receiving an unexpected security call or reset link, the practical response is to treat it as a potential phishing attempt rather than evidence that attackers exposed a wallet.

Keystone has announced no public deadline for its investigation, leaving its next disclosure of affected-customer numbers and the status of records older than 180 days as the first substantive checkpoint for the breach’s reach.