Hardware wallet maker Keystone confirmed that an intruder obtained customer information from its online store. The company says recovery phrases and private keys were not exposed and warns customers about fake refund and device-replacement offers.
Hardware wallet maker Keystone says an intruder obtained customers’ names, contact details, shipping addresses and order information from its online store. In its October 24 announcement, the company said payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed.
Keystone says it blocked the unauthorised access, fixed the vulnerability and opened an investigation. It is emailing affected customers and warning them about calls, texts, emails and letters offering refunds, replacement devices or corrections to orders and addresses.
Access detected October 20, exposure confirmed October 23
The company detected unauthorised access to its official website on October 20. After reviewing API activity with Shopify, it confirmed on October 23 that a third party had obtained customer shipping information. Keystone published its statement on October 24 at 17:59 UTC. It did not say that Shopify’s own platform had been breached.
“We owe you an apology.”
Keystone has not disclosed how many customers were affected, which countries their orders came from or when those orders were placed. It has also not identified the intruder, the date of first access or the technical details of the vulnerability. The company promised a detailed report soon without setting a publication date.
Order records exposed; company says keys were not
| Data type | Company’s statement |
|---|---|
| Names, contact details and shipping addresses | Obtained by a third party. |
| Items ordered and their prices | Included in the exposed order details. |
| Payment card and bank details | Not exposed. |
| Recovery phrases, private keys and wallet passwords | Not exposed. |
A hardware wallet keeps the private keys needed to sign transactions on the device. A recovery phrase is a sequence of words used to restore access to keys in a compatible wallet. In its privacy policy, Keystone says its hardware wallets operate offline and that it does not collect data through those products. Its online store separately retains the information needed to process purchases and deliveries. Keeping a device offline does not protect personal records stored by the shop.
Keystone also says it collects device, application and wallet-usage data through its Nexus companion app. It has not said that all data collected through Nexus was exposed in the breach. The company identifies customer and order records as the exposed information and has not published independent technical findings or a figure for financial losses in its announcement.
Fake support requests can arrive by phone or post
In phishing, a scammer impersonates a trusted person or organisation to obtain sensitive information. Knowing a customer’s name and the device they bought could make a fake refund or replacement offer more convincing. Keystone asks customers to distrust unexpected offers made in its name and to type keyst.one directly into their browser instead of following links in messages. It identifies support@keyst.one as its official support address.
Keep your recovery phrase private. Keystone says its support staff will never ask for a recovery phrase or private key. Do not enter your phrase into a device you did not order. A proposed refund, replacement or address correction is no reason to provide those credentials.
Security researcher Taylor Monahan highlighted another danger in an October 24 post quoting Keystone’s announcement: leaked shipping addresses can expose customers to physical assault and kidnapping. Monahan warned of possible harm; she did not report a physical attack linked to the breach.
In a separate case, Switzerland’s National Cyber Security Centre described fake letters sent to hardware wallet owners in an August 18, 2026 advisory. The letters claimed a critical update was needed for “quantum resistance”; a QR code led to a website asking for the recovery phrase. The scammers allowed more than two weeks to act, reducing the sense of urgency. The agency noted that most links on a polished-looking site could be genuine while the purported update section was fraudulent. No connection has been established between that August campaign and the Keystone breach.
Order data is subject to a 180-day deletion rule
In the privacy policy it updated on July 7, 2026, Keystone says its store runs on Shopify. The company says it erases all order information for each customer who has not placed an order within the previous 180 days. To request earlier deletion, customers must contact support with their order number and the email address used for the order, and explicitly state that there is no dispute concerning the order.
Keystone has not disclosed the age of the records taken or how it applied the deletion rule to them. The 180-day period runs from a customer’s last purchase. The stated rule is therefore insufficient to conclude that only purchases from the past six months were affected.
Keystone’s official statement on the customer data breach
The post loads from X when you open it.
The October 24 post lists the data the company says was exposed, its response and the forms of impersonation customers should watch for.
