Keystone Hardware Wallet Discloses Website Breach Exposing Customer Shipping Data

Keystone Hardware Wallet, the company that sells a physical device built to keep bitcoin out of an attacker’s reach, disclosed on October 24 that a third party obtained its customers’ shipping records through its own storefront. The intrusion was detected on October 20. Keystone confirmed the scope three days later, on October 23, after reviewing API activity with Shopify. The one comfort in the announcement is the part that was not touched: no payment details, recovery phrases, private keys or wallet passwords were taken.

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we’re sorry we didn’t keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.

— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026

The exposed data is narrower than a worst-case breach and, in one respect, worse than the announcement’s measured tone lets on. Keystone named four categories of exposure: names, contact details, shipping addresses and order details, including the items purchased and their prices. The intrusion never reached the cryptographic layer of the product. But a hardware wallet’s security model stops at the device itself. A leaked home address is the one piece of data the device was never designed to protect.

What Was Exposed, and What Keystone Says Was Not

The dividing line in Keystone’s statement runs between commercial data and cryptographic data. “Exposed: names, contact details, shipping addresses, and order details (items and prices),” the company wrote. “Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.” That split means no customer’s funds are directly at risk from this incident, provided the customer does not later hand the keys over to an impersonator.

Read as a ledger, the announcement names eight data categories in total — four exposed and four spared — and exactly zero of the eight are cryptographic. That is the most important arithmetic in the disclosure. The breach stripped the perimeter around a customer’s bitcoin but did not reach the bitcoin itself.

Keystone said it has blocked the access, patched the vulnerability, opened an investigation and is emailing affected customers. It has not yet said how many customers were affected, how long the unauthorized access persisted, or how the attacker got in. Those are the details a fuller report is meant to settle. “A detailed report is coming soon,” the company wrote.

The timeline is worth reading closely. Keystone detected the intrusion on October 20, confirmed the exposure on October 23, and disclosed it on October 24. That is a four-day gap between detection and public disclosure, and a full day between confirmation and the point customers were told. For anyone whose address sat in the exposed set, each of those days was a window in which a scammer could have used real order details before the customer had reason to be suspicious.

A Shipping Address Is the One Thing a Wallet Cannot Guard

Keystone’s product is designed to survive remote attacks. A hardware wallet keeps signing keys offline so that malware on a computer, a drained browser extension or a phishing page cannot move funds without a physical confirmation on the device. That threat model does nothing for a customer whose home address sits in a breached database.

This is the genuine risk in the incident. Names, phone numbers and delivery addresses can be recombined into convincing social-engineering attacks, in which a caller or emailer cites a real order and a real street address to sound legitimate. Keystone itself warned that scammers may pose as its staff “offering refunds, replacement devices, or ‘fixes’ for your order or address.” The goal of that impersonation would be to extract the one thing this breach did not take: the recovery phrase.

For a hardware wallet, that is the entire game. The device converts the problem of securing bitcoin into the problem of guarding a single set of words. Every other layer — the phone, the computer, the storefront — is a perimeter around that secret. Keystone’s breach shows how much of that perimeter is commercial rather than cryptographic.

What Customers Should Do Before the Full Report

Keystone’s guidance to customers is unambiguous. “NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn’t order,” the company wrote. “We will never ask for them.” It told customers to ignore links in unexpected messages and to type keyst.one into the browser themselves rather than following a link in an email or text.

Anyone who bought a Keystone device should treat any message about a refund, a replacement unit, or a correction to an order or delivery address as suspicious unless it clearly originates from the company’s official channels. The breach means a scammer may already know the customer’s name, the device they bought and the address it shipped to. That combination is enough to make a fake support message look real.

Hardware Wallet Security Keeps Getting Tested

The Keystone disclosure lands in the middle of a longer stress test for hardware wallet makers. Earlier this year the industry was absorbing the fallout from a compromised Ledger device that the company said carried an unauthorized hardware implant. That scare pushed Trezor to prune its authorized reseller network, a move it framed as tightening control over the physical supply chain. Keystone’s incident is different in kind — it is a data exposure at the storefront, not a hardware compromise — but it feeds the same pressure.

The common thread is that hardware wallets now have to defend two perimeters at once. The first is the device and its signing process, which is where the strongest engineering effort goes. The second is the ordinary commerce around the device: the store, the shipping data, the support channel. Keystone’s breach shows that the second perimeter can fail without any weakness in the first.

Part of the reason the failure was possible at all is concentration. Keystone confirmed the exposure by checking Shopify’s API activity, which places the storefront on the same e-commerce platform much of the hardware wallet industry uses. The clearest historical parallel is Ledger’s 2020 breach, which exposed customer contact and shipping details through a Shopify-side data leak and triggered years of phishing. In both cases the cryptographic security of the devices was never the weak point. The commercial layer around them was.

The disclosure also sharpens a question that runs through the self-custody market. Hardware wallet firms are, in a practical sense, data controllers: they hold customer names, addresses and purchase records long after the box ships. Yet their disclosure obligations are largely voluntary, set by reputation rather than by the statutory deadlines that bind regulated financial firms. Keystone chose to disclose within a day of confirming the exposure. That is faster than many breach disclosures, and the timing is one reason the incident has not become a worse trust event.

What the promised report should clarify is the scale and the mechanism. How many customers were affected, whether the access was limited to the storefront’s order system or reached further, and what specifically the company changed to close the gap. Until then, the practical posture for any Keystone customer is simple: ignore unsolicited messages about orders or refunds, and keep the recovery phrase where no one can ask for it.