Keystone data breach exposes hardware wallet buyers' shipping addresses

A Keystone data breach has put the shipping addresses of hardware wallet buyers in the hands of an unknown third party. The Hong Kong-based maker of air-gapped, QR-code wallets disclosed on Saturday, Oct. 24, that an intruder had accessed customer information through its official online store.

What happened

Keystone said it detected unauthorized access to its website on Oct. 20 and confirmed on Oct. 23, after checking API activity with Shopify, that customer shipping data had been taken. The exposed fields include names, contact details, shipping addresses and order details such as the products bought and their prices, according to Crypto Briefing.

According to the company, no card or bank data, wallet passwords, private keys or recovery phrases were exposed. It has blocked the access, fixed the vulnerability, opened an investigation and started emailing affected customers, and it promised a detailed report in the coming days. Keystone has not said how many people were affected, Cointelegraph noted. "We owe you an apology," the company wrote on X, adding later: "Again, we're truly sorry to everyone affected."

Some customers say the leak reaches further back than it should. Keystone wrote in 2023 that it had cut its data retention period to 180 days after incidents at rival wallet makers. Yet buyers who purchased devices more than two years ago told Cointelegraph they received breach notices, and one X user said a scammer posing as law enforcement called them with details that matched a 2024 order.

Why it matters

For self-custody users, an address list is more dangerous than an email list. Security researcher Taylor Monahan warned that leaked shipping details could expose holders to physical attacks and kidnappings, not just phishing. CertiK counted 52 verified "wrench attacks" globally between January and June 2026, compared with 39 in the same period of 2025, a 33% rise.

The Keystone data breach is also part of a wider pattern of supply-chain and vendor failures in the wallet business. Trezor disclosed a customer data leak at logistics provider ShipMonk in August, and this month Ledger confirmed that criminals had tampered with genuine devices sold through a reseller. The device itself can be secure while the data around it leaks. Keystone's wallets sign transactions by QR code without USB, Bluetooth or Wi-Fi, and work with software wallets such as MetaMask, Rabby, Keplr and Solflare, so its customer list maps directly onto active crypto holders.

What's next

Keystone warned that fraudsters may pose as company staff offering refunds, replacement devices or help with orders. Customers should ignore unexpected links, never type a recovery phrase into a device they did not order and treat calls about "account problems" as hostile. The same discipline applies after last week's Electrum server flaw, where users were urged to verify every address before signing.

The pending report should show how the store was breached and why older records survived. Until then, affected buyers should assume their name and address are circulating after the Keystone data breach. Details are in Cointelegraph's report.