Hardware-wallet maker Keystone says unauthorized access to its official website exposed customer names, contact details, shipping addresses and order records. The company disclosed the incident on October 24 after detecting access on October 20 and confirming on October 23, through a review of API activity with Shopify, that a third party had obtained customer shipping information.

Commerce records were exposed, not wallet secrets

Keystone said the compromised information included purchased items and prices as well as delivery and contact details. It said payment-card and bank information, recovery phrases, private keys and wallet passwords were not exposed. Independent reports from Crypto Briefing and The Defiant matched the scope described in the company's statement. Keystone has not reported that wallet signing systems were compromised or that cryptocurrency was stolen in connection with the incident.

Related reporting: Brevo SSO flaw enabled phishing email to 347,000 Trezor subscribers

That distinction is important because a hardware wallet protects cryptographic signing material, while a web store holds the ordinary customer information needed to sell and ship the device. A breach of the commerce layer does not automatically give an attacker control of a wallet. However, records showing who bought a hardware wallet, where it was delivered and what was purchased can help criminals create convincing phishing or impersonation attempts. That is a risk assessment, not evidence that affected customers have suffered a second attack.

Keystone warns about tailored scams

The company warned that scammers may pose as Keystone by telephone, text message, email or physical mail. A fraudulent message could refer to a real order, address, refund or replacement device to appear credible. Keystone said it will never request a recovery phrase or private key and advised customers not to enter a recovery phrase into a device they did not order. It also recommended typing the official website address directly instead of opening links in unexpected messages.

The incident exposes a recurring operational gap for self-custody businesses: signing keys can remain offline while purchase data stays in conventional cloud commerce systems. Those records can connect a real identity and location to the purchase of a security device. Even without wallet balances or secret phrases, that combination can make a false support message more persuasive. Keystone's warning therefore focuses on social engineering rather than a technical wallet-recovery process.

Containment is reported, but the scale remains unknown

Keystone said it blocked the unauthorized access, fixed the vulnerability, opened an investigation and began emailing affected customers. The disclosure did not state how many people were affected, which countries were involved, how long the third party could access the records or whether the data has been misused. It also did not identify a detailed root cause beyond the Shopify API activity reviewed during the investigation.

The company said a fuller report will be published in the coming days. Until that report provides a timeline, affected population and technical findings, the available evidence supports a limited conclusion: ecommerce customer information was exposed, while Keystone says payment credentials and wallet secrets were not. Customers receiving a notice should verify it through the company's official channels rather than trusting contact details or links inside the message itself. The accompanying image is an AI-generated conceptual illustration, not a photograph of the incident or an affected customer.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.