Keystone breach exposes wallet buyers' shipping data
Keystone says a third party took customer names, contacts, home addresses and order data from its store. Keys and seed phrases were not affected; expect scams.
CryptoGroup Newsroom · · 3 min read
On this page
Hardware wallet maker Keystone says an outsider obtained its customers' names, contact details, home shipping addresses and order details from its official online store, Crypto Briefing reports, citing a statement the company posted on X on 24 October. Keystone stresses that no wallet was touched: payment and bank details, recovery phrases, private keys and wallet passwords were not part of the leak.
What Keystone disclosed
- 20 October: Keystone detected unauthorised access to its website.
- 23 October: after checking API activity with Shopify, its e-commerce platform, it confirmed that a third party had obtained customer shipping information.
- Data taken: names, contact details, shipping addresses, and order details including the items bought and what was paid.
- Response: the company says it blocked the access, fixed the vulnerability, opened an investigation and is emailing affected customers. A detailed report is promised within days.
Keystone has not said how many customers are affected, which order dates are involved or exactly how the attacker got in. Its reference to Shopify API logs does not mean Shopify's wider platform was breached.
Why a "harmless" leak still matters
A shipping list does not unlock a single wallet, but it tells criminals who owns a self-custody device and where they live. That makes impersonation far more convincing: a caller who can quote your real order, or a parcel with a "replacement" device, looks legitimate. Keystone itself warns that scammers may pose as the company by phone, text, email or post, offering refunds, new devices or "fixes" to an order or address.
Keystone is not the first. Trezor disclosed a customer-data breach at its logistics provider in August, and Ledger's 2020 marketing-database leak led to years of phishing letters and even tampered devices sent by post. For how hardware wallets protect keys, and why the device alone is not the whole story, see our explainer.
What Keystone customers should do
- Never enter your recovery phrase into a website, app, form or any device you did not order yourself. No real support team will ask for it — read what a seed phrase is if you are unsure why.
- Ignore links in unexpected messages. Type the company's address yourself.
- Treat unsolicited parcels as hostile. Do not plug in or set up a device that arrived without an order.
- Watch for "urgent" stories about frozen funds, failed deliveries or refunds. Our guide on how to spot crypto scams lists the common scripts.
Frequently asked questions
Were Keystone wallets or funds compromised?
According to Keystone, no. The breach affected customer data held by its online store; recovery phrases, private keys, wallet passwords and payment details were not exposed, and no loss of funds has been reported.
What data was exposed in the Keystone breach?
Customer names, contact details, shipping addresses and order details, including items purchased and prices, according to the company's 24 October statement.
Should I move my coins to a new wallet?
Keystone has not said that is necessary, because keys were not exposed. The practical risk is phishing: never type your recovery phrase anywhere and ignore offers of refunds or replacement devices you did not request.
This article is for information only and is not financial advice. Crypto assets are volatile; do your own research. Read our disclaimer
More from Security
View all →Read next
What is USDT (Tether)? How it works, risks and uses
USDT explained: how Tether's dollar stablecoin keeps its $1 price, what backs it, which networks it runs on, why addresses can be frozen and the key risks.
House of Doge loses exclusive Dogecoin license: 5 key points
A House of Doge 8-K ends its exclusive Dogecoin Foundation license, owes $400,000, needs a new name by Dec. 31 and plans a $15M McQueen Labs deal.
Bitcoin back near $81,000 after $810M wipeout, Fed week next
Bitcoin recovered to about $80,900 on Sunday after a $79,146 low and $810M in liquidations. The Fed decides on Oct. 28; traders eye the $81,700 50-day average.