Keystone Hardware Wallet has confirmed a security breach that exposed customer names, contact details, shipping addresses, and purchase information after unauthorized access to its official website. The incident raises concerns about phishing attempts and physical security risks for cryptocurrency holders, although the company said wallet credentials and payment information were not compromised.
The company detected unauthorized access on October 20 and confirmed the data theft on October 23 after reviewing application programming interface (API) activity with Shopify. In its October 24 disclosure, Keystone apologized to affected customers and said it had blocked the access, fixed the vulnerability, and started notifying people whose information was exposed.
Also Read | Internet Computer Records Lowest Transaction Fee as ICP Price Eyes Recovery
Keystone Hardware Wallet Confirms Customer Data Theft
The exposed data comprised of names, contact details, shipping addresses, product information, and price of the prices of the customers’ products. Keystone stated that no payment card information, banking information, recovery information, private key, or wallet password had been exposed. The company has not disclosed the number of affected customers or identified the person responsible for the unauthorized access.
Keystone said that it is investigating the matter and it will issue an incident report in due course. The statement issued by the company regarding Shopify API indicates that part of the process was used to verify the exposure, but it does not mean that there was a breach on Shopify Platform.
Exposed Customer Details Raise Phishing Concerns
The incident matters because customer information can help criminals create convincing scams. Attackers can use customer information to imitate the company, reference a legitimate order or state that a shipment requires correction. In cases where the attacker has an address and a product in mind, then the phishing attempt is believable.
The company informed customers about fake refund requests, requests for replacements and fixing of orders. Customers were advised to be sure by validating all messages through official communication channels and not sharing their recovery phrases or private keys. Customers are advised to ensure that they do not input wallets backups to websites or devices that they did not purchase.
The exposure also creates potential physical security concerns because shipping addresses can connect a real-world identity with a cryptocurrency-related purchase. Developer Tay Monahan has expressed concern about the possible physical attacks on buyers of Keystone hardware wallets. It should be noted that Keystone does not have reports of robberies, kidnapping or other physical threats.
Ledger Breach Shows Long-Term Risks of Data Leaks
The attack on Keystone brings back memories of Ledger’s breach of its e-commerce database in 2020 that resulted in the leakage of customer email addresses and personal details such as names and postal addresses. Later on, Ledger warned that these stolen records could be used to conduct a phishing scam against owners of the Keystone hardware wallets.
In April 2025, there were reports about fraudulent letters sent to Ledger’s customers who were asked to scan a QR code and enter their wallet recovery phrase. These fraudulent letters proved how thieves could make their fake security messages look like real by using the leaked customer information. However, no evidence is present to indicate the connection between these campaigns and Keystone’s current one.
Customer Data Breaches Highlight Keystone Hardware Wallet Security Risks
A separate incident involving Trezor provides further context. In August 2026, the manufacturer of Keystone hardware wallets reported about a data breach of their shipping provider, ShipMonk. Later, on September 4, Trezor made an update saying that 67,000 more US customers were compromised due to their old orders not being properly deleted.
Personal information, including full names, email addresses, phone numbers, shipping addresses, and order numbers was stolen. According to Trezor, this issue did not affect their system or devices, but the information may be used for sending phishing emails, making fake calls, sending letters, and possibly posing a threat to security. This example shows the dangers that companies face while keeping their customer records with external partners.
The main difference between these two examples is the source where the personal data was stolen: in Keystone’s case, it was the official website, whereas in Trezor’s example, it was their shipping company. In any case, protection of personal information should consider these aspects of online systems and companies that store orders.
Keystone Investigation and Customer Notifications Continue
Keystone has prevented any unauthorized access and resolved the vulnerability reported by customers, and they have already started contacting affected clients. An upcoming incident report from Keystone will give more information regarding the breach, the number of people affected, and how it was prevented from recurring. Keystone has not revealed such information in its announcement as of now.
The client must remain cautious about receiving any unexpected messages about their refund, replacement of device, or security concerns about the account. They can cross-verify the message through the Keystone website rather than using the contact information given in the messages. An authorized Keystone hardware wallet manufacturer doesn’t need to receive the recovery phrase or private keys of the user in case of shipping issues.
Also Read | Maelstrom Crypto Selloff Sees $22.28 Million in ETH and Altcoin Sales
Be the first to comment