Keystone Hardware Wallet Announces Data Breach, Customer Shipping Information Exposed

On October 25th, hardware wallet manufacturer Keystone announced via its official social media channels that its website had been subjected to unauthorized access. The company first detected suspicious activity on October 20th. After reviewing API logs in coordination with e-commerce platform Shopify, Keystone confirmed on October 23rd that a third party had obtained certain customer data.

Scope of the Compromised Data

The information accessed relates primarily to order details submitted by customers during the purchase process. The exposed data includes:

  • Customer names and contact information
  • Full shipping addresses
  • Order specifics, such as product types and prices paid.

Keystone's statement strongly emphasized that no sensitive financial or cryptographic data was accessed. Customer payment card details, bank information, wallet recovery seeds, private keys, and wallet passwords remain secure and were not part of this breach.

Company Response and Remediation

Upon identifying the issue, Keystone's security team implemented several countermeasures:

  • Blocked the unauthorized access point.
  • Patched the underlying security vulnerability.
  • Initiated a comprehensive investigation to determine the root cause and full impact.
  • Began the process of directly notifying affected users via email.

Heightened Risk of Targeted Phishing Attacks

With attackers in possession of accurate names, addresses, and order details, Keystone warned customers of a significantly increased risk of sophisticated phishing attempts. Scammers may now:

  • Pose as legitimate Keystone support staff, contacting users via phone calls, SMS, email, or even physical mail.
  • Use pretexts like "order refunds," "required device replacements," or "security updates" to gain trust.

All users should remember: Keystone or its genuine partners will never ask for your recovery seed, private keys, or wallet password. Any such request is a scam. If you receive suspicious communication, verify it through official channels.

For Keystone hardware wallet owners, the security of the device itself remains intact. The safety of assets still fundamentally depends on the user's offline custody of seeds and keys. This incident serves as a broader reminder that protecting personal information is crucial at every stage, including the point of purchase.