TLDR
- Keystone confirmed a website breach that exposed customer names, contact details, shipping addresses and order details.
- The company says payment data, recovery phrases and private keys were not exposed.
- Keystone has not said how many customers were affected.
- Several users say their data from orders older than 180 days was leaked, despite the company’s deletion promise.
- Keystone follows Trezor, SafePal and Ledger as wallet makers reporting customer data leaks this year.
Hardware wallet maker Keystone has disclosed a website breach that exposed customer shipping information. The company shared the news on Saturday.
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…
— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026
Keystone said it detected unauthorized access to its website on Oct. 20. On Oct. 23, after checking API activity with Shopify, it confirmed that a third party had obtained customer data.
The exposed data includes names, contact details, shipping addresses and order details. Order details cover the items bought and their prices.
Keystone said payment card data, bank details, recovery phrases, private keys and wallet passwords were not exposed. The company has not said how many customers were affected.
“We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” the company said. It also apologized to those affected.
What Keystone told customers
Keystone warned that scammers may pose as the company by phone, text, email or mail. They may offer refunds, replacement devices or fixes.
The company told users never to enter a recovery phrase into a device they did not order. It also said not to follow links in messages that claim to come from Keystone.
Security researcher Taylor Monahan raised concerns that leaked shipping addresses could lead to physical attacks. Such crimes are often called wrench attacks.
Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026. That is up 33% from 39 in the same period last year.
Questions over data deletion
Keystone has said it deletes shipping data 180 days after an order. The promise appears on its Privacy Promise page and in posts on X.
Several customers say their older data was exposed anyway. One user said they bought a device over two years ago and still received a breach email.
Another user said 214 days had passed since their last order. A third said a caller spoofing a Montreal police number knew details from a 2024 Keystone order.
Keystone’s privacy policy words the rule differently. It says the company erases order information for customers who have not ordered in the last 180 days.
A help center article says records of a customer’s city and country are not deleted. It adds that Shopify handles the final deletion.
Keystone is the latest wallet maker to report a leak this year. Trezor said a ShipMonk breach exposed data of nearly 14,000 customers, and later added about 67,000 more U.S. customers. SafePal reported a flaw affecting nearly 40,000 customers.
