✓ Verified by 4+ outlets BTC
Keystone breach widens: hackers took buyers' data and a key used to verify its hardware wallets as genuine
Summary
Hardware wallet maker Keystone said an unauthorized third party obtained customer names, contact details, shipping addresses and order details from its Shopify-powered online store, The Block and Cointelegraph reported.
According to The Block, Keystone said it detected unauthorized access to its website on Oct. 20 and confirmed on Oct. 23, after verifying API activity with Shopify, that customer data had been taken; Keystone says payment details, recovery phrases, private keys and wallet passwords were not exposed.
Keystone has not said how many customers were affected, and both outlets said their questions to the company went unanswered at publication time.
Several customers said on X that they were notified even though their orders were more than 180 days old, which both outlets note conflicts with Keystone's repeated promise to delete shipping data within 180 days; The Block said it could not verify those claims.
Keystone warned of targeted phishing, and Cointelegraph reported that security researcher Taylor Monahan raised concerns that leaked addresses could also expose holders to physical attacks and kidnappings.
Updates
- Update, : Update (Oct. 26): Keystone said the attacker also stole a key used to verify its devices are genuine, which it said could let counterfeit wallets pass authenticity checks. It plans to destroy 18,835 devices in inventory with the compromised key and has paused shipments of devices using it, Cointelegraph reported.
- Update, : Update: CoinDesk also reported Keystone's plan to destroy almost 19,000 devices, and said some of the 25,964 exposed buyer records were kept past the 180-day deletion policy after an automated tool failed without the firm noticing.
- Update, : Update (Oct. 27): Decrypt reported Keystone has suspended shipping of unshipped website orders and will switch to preorders until devices with a new key are made, cut its data retention from 180 to 90 days, and expects Shopify to finish erasing overdue buyer data on Nov. 3. Keystone said it will not ask customers to return devices and that anyone requesting one under a "recall" is a scammer.
Key facts
- Keystone said: "We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers."
- Keystone said a detailed report on the breach will follow in the coming days.
- Keystone's Privacy Promise page says all shipping information is automatically deleted 180 days after an order, while its May 2021 privacy policy words the rule as erasing data for customers who have not ordered within the last 180 days.
- One X user said 214 days had passed between their last order and the breach; another said they bought their device over two years ago and still got a notification.
- An X user said a scammer posing as law enforcement called them with details matching a Keystone order placed in 2024.
- CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 a year earlier.
- Keystone told customers never to enter a recovery phrase into a device they did not order and not to follow links in messages claiming to be from Keystone.
- Earlier in 2026, Trezor and SafePal also disclosed customer data leaks, which The Block said affected tens of thousands of customers.
- Keystone said the attacker exploited a vulnerability in a third-party monitoring tool on its website to escalate privileges and obtain customer information and a device authentication key.
- Keystone said devices made and delivered before the Oct. 20 incident should be considered safe, but it could not guarantee the authenticity of devices delivered after that date and urged those customers to contact support.
- Keystone said its Shopify store generated 51,083 buyer records; 25,119 had been deleted under its 180-day retention policy, while 25,964 records from 2024 to 2026 may have been stolen after its bulk-erasure tool failed.
- The attacker may also have accessed 12,873 incomplete checkout records retained by Shopify, Keystone said.
Related stories
- Bitcoin drops below $72,000 as spot ETFs bleed $1.44 billion in five days and BlackRock's IBIT loses $2 billion in nine
- Bitcoin treasury firm Nakamoto owes Kraken $165 million, more than its market value, as Q3 operating revenue turns negative
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor