Keystone has confirmed that a third party obtained customer shipping information from its Shopify-powered online store, including names, contact details, shipping addresses and order details such as the items purchased and their prices. Payment card and bank details were not exposed, and neither were recovery phrases, private keys or wallet passwords. Keystone disclosed the breach on 24 October 2026 but has not said how many customers were affected, and that silence is part of the story: a home address tied to a hardware-wallet purchase can help scammers identify people who may own cryptocurrency and where they live.
What happened, and when
Keystone detected unauthorised access to its official website on 20 October 2026. Three days later, after verifying API activity with Shopify, which powers its online store, the company confirmed that an unidentified third party had obtained customer shipping information. Early on Saturday 24 October, Keystone replied on X that it had initiated an urgent investigation, and at 1:59 p.m. ET that day it published a post headed “We owe you an apology”, writing: “You trusted us with those details, and we’re sorry we didn’t keep them safe.”
Keystone says it has blocked the access, fixed the vulnerability, opened an investigation and is emailing affected customers. It says a detailed report will follow in the coming days, and it has told users asking about the scope that it is still conducting a thorough investigation. It has not said how the attacker got in, or whether it has exchanged communications with or identified the attacker.
What was taken, and what was not
Taken, as listed by Keystone: names, contact details, shipping addresses and order details, including the items purchased and their prices. Not taken, as stated by Keystone: payment card and bank details, recovery phrases, private keys and wallet passwords. The distinction matters. This was a breach of the company’s online store, not a compromise of the wallets themselves, and Keystone says no cryptographic secrets were exposed. But the exposed data is still valuable for impersonation scams, because an order record can link a person to a hardware-wallet purchase and show what was ordered and where it was shipped.
Keystone is best known for fully air-gapped, QR-code-based transaction signing, which keeps private keys offline without USB, Bluetooth or Wi-Fi. It is a Hong Kong-based self-custody brand that expanded from Bitcoin-focused origins into a multichain wallet.
The 180-day promise customers are now disputing
Keystone had pitched its retention policy as a selling point. On 5 January it posted on X: “180 days after your order, your shipping data is permanently deleted.” In a March post it wrote: “Other hardware wallets keep your data forever. We delete your shipping info in 180 days max.” Its Privacy Promise page says all shipping information is automatically deleted 180 days after an order is placed. But its privacy policy, last updated in May 2021, words the rule differently: it says Keystone erases all order information of each customer who has not made an order within the last 180 days. And a help centre article clarifies that records of the customer’s city and country will not be deleted, and that the final deletion process is handled by Shopify.
Several customers have said on X that their data was exposed anyway, and those claims are unverified. One user said 214 days had passed between their last order and the breach, which is 34 days past the stated 180-day limit, but that is arithmetic on an unverified claim, not proof that this customer’s data was exposed. Another said they bought a device over two years ago and still received an email notification. A third customer alleged that a caller spoofing a Montreal police number used details matching a 2024 Keystone order. The allegation remains unverified, and the source of the caller’s information has not been established. The Block, which reported these claims, states it could not verify them, and Keystone has not publicly responded to questions about whether it followed the 180-day policy.
The investigation should clarify which retention policy applied to the exposed records and whether any records remained accessible after the advertised deletion period.
What to do if you bought from Keystone
- Treat any offer of a refund, a replacement device or a fix for your order or address as a scam if it arrives by phone, text, email or mail.
- Never enter a recovery phrase into a device you did not order.
- Do not follow links sent in messages supposedly from Keystone.
Keystone itself issued all three warnings, and the spoofed-call claim above shows why they matter: the caller in that unverified account allegedly already knew the victim’s order details.
A wider wave of hardware-wallet breaches
Keystone is the latest hardware-wallet maker to disclose a customer data leak this year. In August, Trezor said a breach at its shipping partner ShipMonk exposed personal data of nearly 14,000 customers, then later said the breach affected about 67,000 more US customers, and that ShipMonk had given written assurances the data was deleted when it had not been. Our calculation, labelled as TechReview’s own analysis: those two figures imply a Trezor total of about 81,000 customers. Days after Trezor’s first disclosure, SafePal said a flaw in its order-tracking system exposed personal information of nearly 40,000 customers. Earlier in October, Ledger confirmed that devices sold by reseller CryptoBilis contained hardware implants that capture recovery phrases during setup, and onchain researchers estimated losses at more than $86 million, a total that remains unconfirmed.
Neither the Trezor, SafePal nor Ledger incident is connected to Keystone’s breach; they involve different companies and systems. Keystone’s count, unlike theirs, is undisclosed, so it cannot be ranked against them on size. The pattern is the point: three 2026 exposures of order or shipping data, and two of the three involve a deletion assurance that later unravelled, ShipMonk’s written assurance, which Trezor’s own follow-up disproved, and Keystone’s 180-day promise, which customers have disputed in claims that remain unverified.
Frequently asked questions
Were my coins stolen? Keystone says no. Recovery phrases, private keys and wallet passwords were not exposed. This was a breach of its online store’s customer data, not a compromise of the wallets themselves.
How many customers were affected? Keystone has not said. It says it is still conducting a thorough investigation, and no order-date range for the exposed records has been disclosed.
Will Keystone say more? The company says a detailed report will follow in the coming days. The open questions are the affected count, the attack method, and the 180-day policy.
