Keystone, a maker of hardware wallets, says someone broke into its online store and took customer data. In a post on X on Saturday, October 24, 2026, the company said the stolen information includes buyers’ names, contact details, home shipping addresses and order details. It apologized and said it is emailing the customers who were affected.
Key facts
- Keystone spotted unauthorized access to its official website on Tuesday, October 20.
- On Friday, October 23, after checking activity on the systems of Shopify (the platform that runs its store), it confirmed that an outsider had taken customer shipping data.
- The data includes what each customer bought and how much they paid.
- Keystone says no payment card or bank details, recovery phrases, private keys or wallet passwords were exposed. The devices themselves are not affected, and no stolen funds have been reported.
- The company says it has blocked the access, fixed the weak spot and opened an investigation. A detailed report is promised “in the coming days”.
- Keystone has not said how many customers were affected.
Questions about old data
- Keystone has said for years that it deletes shipping data 180 days after an order.
- Several customers say on X that they got a breach notice even though their order was more than two years old. One said a caller pretending to be the police knew details from a 2024 order.
- These claims have not been independently checked, and Keystone has not yet explained them.
Part of a bigger pattern
- In 2026 alone, shipping or order data of customers was also leaked at Trezor (through a shipping partner) and SafePal (through a bug in an order-tracking plug-in), affecting tens of thousands of buyers.
- Security researchers warn that a list of people who own crypto hardware wallets, with their home addresses, can be used for targeted scams and even physical “wrench attacks”, where criminals threaten people at home to make them hand over their coins.
What Keystone customers should do
- Be careful with any call, email, text or letter that claims to be from Keystone and offers a refund, a replacement device or a “fix” to your order.
- Never type your recovery phrase into a website, an app or a device you did not order yourself. No real company will ask for it.
- If a device arrives that you did not order, do not use it.
Why it matters
Hardware wallets are meant to be the safest way to keep crypto, and this breach does not change that: the coins on Keystone devices are still protected. But the people who bought them are now easier to find. Leaked names and home addresses of crypto owners are a gift for scammers and, in the worst cases, for criminals who show up in person. It is a reminder to buy carefully, share as little personal data as possible, and treat any unexpected message about your wallet as a likely scam.
This article is for information only and is not financial advice.
