Keystone Confirms Customer Data Breach Following Unauthorized Website Access

TLDR:

• Keystone detected unauthorized website access on October 20 and confirmed customer data exposure October 23.
• Exposed records included customer names, emails, phone numbers, shipping addresses, products and prices.
• Keystone said payment details, wallet passwords, private keys and recovery phrases were not compromised.
• Keystone has not identified the attacker, the number of affected customers or the duration of website access.

Keystone Hardware Wallet confirmed that unauthorized access to its website exposed customer names, contact details, shipping addresses and purchase records. The breach, detected October 20, 2026, was confirmed three days later following a review of Shopify application programming interface activity.

In an October 24 disclosure, the hardware wallet manufacturer said an unauthorized third party had obtained order information. The company blocked access, fixed the identified vulnerability and opened an investigation, while the number of affected customers remained undisclosed. No tally of affected transactions accompanied the disclosure.

The incident exposed records linked to cryptocurrency storage device purchases, rather than information held inside the wallets themselves. The compromised records listed purchased products and prices, alongside customer identities and delivery locations. The affected information connected device purchases to identifiable customers, but no wallet credential compromise was reported.

Keystone Website Intrusion Exposes Customer Orders and Addresses

Shopify operates the manufacturer’s online store and processes its order information, according to the company’s privacy policy. That policy also says records are deleted after 180 days when customers have not placed another order.

The deletion provision does not identify which historical purchases were included in this breach. However, the disclosure did not identify the affected purchase dates or establish how long unauthorized access remained possible.

Investigators have not publicly attributed the intrusion or explained the precise method used to enter the website. Affected customers were being notified by email. The company also said a fuller incident report would follow, although it supplied no publication date.

Keystone said payment card numbers, bank account details, wallet passwords, private keys and recovery phrases were not exposed. Its wallets use offline transaction signing, with QR-code communication limiting direct connections to internet-enabled devices.

Private Keys Remain Secure as Phishing Warnings Intensify

Nevertheless, the company warned customers about fraudulent refund offers, replacement device schemes and messages claiming to provide order assistance. Such approaches may appear through email, phone calls or text messages.

Customers were advised not to share recovery phrases or private keys, enter recovery phrases into unexpected replacement devices, or follow suspicious links. The company also urged verification through official communication channels.

The breach joins other customer data incidents involving hardware wallet sellers. In August, Trezor disclosed a ShipMonk shipping-provider breach, later identifying approximately 67,000 additional affected U.S. customers.

SafePal also disclosed an order-tracking authorization flaw affecting 39,798 customers. In that case, personal and purchase records were exposed without direct compromise of wallet credentials.

Across these incidents, exposed information sat in ordering or fulfillment systems rather than wallet signing mechanisms. Keystone has yet to publicly disclose its affected customer count, the underlying access method or the exposure window.

The post Keystone Confirms Customer Data Breach Following Unauthorized Website Access appeared first on Blockonomi.