Keystone confirmed exposure of customer contact and order information. The company says private keys and recovery phrases were unaffected. Order-specific phishing messages are the main immedi
Keystone Hardware Wallet has confirmed that an unauthorized third party obtained customer shipping and purchase information through access to its website, potentially giving scammers the details needed to impersonate the company.
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we’re sorry we didn’t keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or “fixes” for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn’t order. We will never ask for them. Don’t click links in unexpected messages. Type https://t.co/7km8AZM288 yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We’d rather hear from you than have you take a chance.
Again, we’re truly sorry to everyone affected.
— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026
Keystone detected the incident on October 20 and confirmed the data exposure on October 23 after reviewing API activity with Shopify, its e-commerce provider. The compromised information included names, contact details, shipping addresses, purchased products and prices.
The company says payment card and bank information, recovery phrases, private keys and wallet passwords were not exposed. It has blocked the unauthorized access, corrected the vulnerability and begun notifying affected customers.
For wallet owners, the immediate issue is targeted impersonation, not a confirmed compromise of their cryptocurrency. Someone with genuine order details could use them to make a fraudulent support request appear legitimate.
The breach involved information collected through Keystone’s online sales operations. The company has not reported a compromise of its hardware wallet firmware or signing mechanism.
Several details remain unresolved, however.
Keystone has not publicly established how many customers were affected, which order dates were involved or how long the unauthorized party could access the information.
It has also not published the underlying technical cause.
The reference to Shopify API activity does not establish that Shopify’s infrastructure was breached. The entry point could involve Keystone’s website or an associated integration, but the available disclosure does not identify which.
That distinction matters for customers trying to determine their exposure. An order date alone cannot confirm whether a particular purchase was included in the breach.
Keystone’s privacy policy identifies Shopify as its online store provider and describes a 180-day inactivity-based retention period for order information. Whether the exposed records fell within that period remains an open question.
Until Keystone provides an affected-order window or individual confirmation, customers should not assume that an older purchase was excluded.
The exposed purchase details can make a fraudulent message more convincing than a generic cryptocurrency scam.
An attackercould reference the recipient’s actual wallet model, purchase price or shipping address, then claim that a refund, replacement device or order correction is required.
The decisive warning sign is the action requested, not whether the message contains accurate information.
A legitimate-looking order reference does not authenticate the sender. Email display names can be spoofed, SMS sender names are not reliable proof of origin, and a website can imitate Keystone’s branding.
A message becomes especially suspicious when it asks a customer to enter a recovery phrase, connect a wallet to an unfamiliar website, approve an unexpected transaction or initialize a replacement device using existing credentials.
Keystone has specifically warned about impersonation attempts involving refunds, replacements and order problems.
A fraudulent message might also include a link whose domain resembles Keystone’s official website but uses extra words, altered spelling or an unrelated domain ending.
Customers should not rely on the appearance of the sender address alone. The full destination URL and the requested action matter more.
The appropriate response depends on whether a customer has merely received a suspicious message or has already disclosed wallet credentials.
Customers who have not disclosed their recovery phrase and have no evidence of device tampering do not need to move their funds solely because their shipping information may have been exposed.
Changing an online store password may be appropriate if that password was reused elsewhere, but Keystone has not identified customer account passwords among the exposed data categories.
Keystone says the vulnerability has been fixed, but its disclosure leaves three important questions for customers: which orders were affected, how the unauthorized access occurred and whether the attacker retained copies of the information.
The answers will determine how precisely customers can assess their exposure and whether additional protective measures are warranted.
The company has begun notifying affected buyers, but the absence of a notification should not yet be treated as confirmation that a customer’s information was excluded.
For now, the most useful precaution is to verify unexpected communications independently, particularly those referring to genuine purchase details. A customer data breach can provide the starting point for a convincing fraud attempt, but it does not by itself give an attacker control of a hardware wallet.
Keystone’s next technical disclosure will be important for establishing the incident’s full scope and whether the remediation addresses the underlying cause.
The post Keystone Wallet Data Breach: What Customers Need to Check appeared first on ETHNews.
