Key Highlights
- Keystone detected unauthorized access to its official Shopify-based store on October 20, 2026, and confirmed three days later that customer names, contact details, shipping addresses, and order information had been exposed.
- According to the official statement, Payment card numbers, bank details, recovery phrases, private keys, and wallet passwords were not compromised.
- Keystone said wallet funds remain safe because cryptographic secrets stayed secure. The company has patched the vulnerability and launched an investigation.
Hardware wallet maker Keystone has confirmed that unauthorized access to its official website exposed customer personal and order information. The company detected the intrusion on October 20, 2026, and verified the data exposure three days later after reviewing API activity with Shopify, which supports its online store.
In a public statement posted on X on October 24, Keystone apologized to customers. “You trusted us with those details, and we’re sorry we didn’t keep them safe,” the company said. The breach involved an unidentified third party obtaining sensitive records from the Shopify-based storefront.
What Data Was Exposed
According to Keystone, the compromised information includes customer names, contact details, shipping addresses, and order details such as the specific items purchased and their prices. The company stated that more critical data remained secure. Payment card numbers, bank details, recovery phrases, private keys, and wallet passwords were not exposed.
Keystone produces air-gapped hardware wallets that sign transactions offline, typically via QR codes, reducing direct internet exposure of cryptographic material. The firm has not disclosed how many customers were affected or the exact method the attacker used to gain access.
Company Response and Customer Notifications
Keystone said it blocked the unauthorized access, patched the underlying vulnerability, launched an internal investigation, and began emailing affected customers. The company plans to release a more detailed incident report in the coming days.
It specifically warned users about potential phishing and social-engineering attacks. Scammers may impersonate Keystone staff by phone, text, email, or mail, offering refunds, replacement devices, help with shipping addresses, or order fixes. The company stressed that it will never ask customers for recovery phrases or private keys.
Keystone previously stated in a 2023 blog post that it had shortened its customer data retention period to 180 days after similar incidents affected other hardware wallet makers. Some customers have reported receiving breach notifications for orders placed more than 180 days, or even years, earlier.
These claims have not been independently verified by Keystone in public responses so far, and the company has not clarified whether older records remained in its systems.
In September, a crypto hack caused the loss of more than $768.5 million, which is approximately 462% higher than the previous month of August and the largest month of 2026.
Security researchers have noted that leaked shipping addresses and proof of hardware wallet ownership can enable targeted phishing as well as physical risks. One researcher highlighted the potential for real-world threats when home addresses of crypto users become known. Similar customer data exposures have previously affected other hardware wallet brands.
The Keystone incident comes weeks after a separate high-profile supply-chain attack involving Ledger hardware wallets. In early October 2026, attackers distributed tampered Ledger devices sold through a Southeast Asia reseller. The devices contained a hidden hardware implant that captured recovery seed phrases displayed on the screen during setup and transmitted them to the attackers.
On-chain estimates put related losses at roughly $86 million to over $100 million across hundreds of wallets. Ledger confirmed its own systems, chips, and operating software were not compromised and described the event as a localized distribution attack.
Keystone emphasized that wallet funds themselves are not at direct risk from this incident because cryptographic secrets were not compromised. Users are advised to remain vigilant against unsolicited contact claiming to be from the company, verify any communications through official channels only, and avoid sharing sensitive wallet information.
The investigation remains ongoing. Keystone has not identified the attacker or provided a full timeline of how long unauthorized access may have existed before detection on October 20. Customers who placed orders through the official store should check their email for official notifications and monitor for suspicious activity related to their personal details.
