TLDR
- Keystone Hardware Wallet said its website was accessed without authorization on October 20.
- Customer names, contact details, shipping addresses and order details were exposed.
- Payment details, private keys, wallet passwords and recovery phrases were not compromised.
- Keystone warned customers about scammers posing as company staff.
- The company plans to release a detailed report in the coming days.
Keystone Hardware Wallet said its website was accessed without authorization, exposing customer information. The company disclosed the breach on Saturday.
Keystone Confirms Customer Data Exposure Following Unauthorized Website Access
Keystone Hardware Wallet confirmed that a third party obtained customer shipping and order information following unauthorized access to its official website. The incident was detected on October 20,… pic.twitter.com/tZMXH6xIHZ
— Wu Blockchain (@WuBlockchain) October 24, 2026
The access happened on October 20. Keystone said it detected suspicious activity and then reviewed API activity with Shopify, its e-commerce provider.
By October 23, the company confirmed that a third party had obtained customer data. Keystone then blocked access and patched the vulnerability.
What Data Was Exposed
The exposed information includes customer names, contact details and shipping addresses. It also includes order details, such as items purchased and prices.
Keystone said payment card and bank details were not compromised. Wallet passwords, private keys and recovery phrases were also not affected.
The company has not said how many customers were affected. It also has not said exactly how the unauthorized access occurred.
Keystone opened an investigation and is notifying affected customers by email. It described the investigation as thorough.
Scam Warnings for Customers
Keystone warned that scammers could use the incident to pose as company representatives. They may offer refunds, replacement devices or help with orders and shipping addresses.
The company urged customers to avoid unexpected links. It said customers should never share recovery phrases or private keys.
Keystone also said customers should not enter recovery phrases into devices they did not order. It said it never asks for recovery phrases or private keys.
An X user known as OG Degen posted a day before the confirmation. The user said they received a call from a spoofed Montreal SPVM number and that the caller tried to social engineer them. Binance founder CZ also commented on the breach on X.
Keystone is a Hong Kong-based wallet brand known for air-gapped, QR-code-based transaction signing. This keeps private keys offline without USB, Bluetooth or Wi-Fi.
The company grew from Bitcoin-focused origins into a multichain wallet. It supports Ethereum, Solana, Polkadot and Cosmos through software wallets such as MetaMask, Solflare, Keplr, Rabby and OKX Wallet.
Other hardware wallet makers have faced security problems in 2026. Trezor disclosed in August a customer data breach at its logistics provider ShipMonk.
Ledger confirmed earlier this month that criminals modified genuine wallets to steal recovery phrases and resold them through Southeast Asian resellers. Coldcard faced a bug involving weak seed generation, and Safepal disclosed a customer information breach.
Keystone said it plans to release a detailed report on its investigation in the coming days. It posted its disclosure on X on Saturday at 1:59 p.m. ET.
Be the first to comment