Hardware-wallet maker Keystone says an unauthorized party obtained customer shipping and order information from its online store, creating a risk of highly targeted impersonation even though the company says recovery phrases, private keys and wallet passwords were not exposed. The company disclosed the incident on October 24 after detecting unauthorized access to its website on October 20 and confirming the data removal three days later through a review of Shopify API activity.

What Keystone says was exposed

Keystone's notice lists customer names, contact details, shipping addresses and order records, including the products purchased and prices paid. It says payment-card and bank details were not part of the exposure. The company also draws a line between the e-commerce breach and the cryptographic secrets used to control assets: recovery phrases, private keys and wallet passwords were not exposed, according to its statement. That distinction is important because the incident does not establish that Keystone devices, firmware or customers' onchain funds were compromised.

Related reporting: Keystone Website Breach Exposes Customer Shipping Data

Targeted scams are the immediate risk

Shipping data can still be sensitive for hardware-wallet buyers because it may identify people who hold crypto and reveal where devices were delivered. Keystone warned that scammers could use phone calls, texts, emails or physical mail to pose as the company and offer refunds, replacements or order fixes. It told customers not to share recovery phrases or private keys, not to enter a recovery phrase into an unordered device, and to avoid links in unexpected messages. A caller knowing a buyer's name, address or past order is therefore not proof that the caller is legitimate.

The response and the missing details

Keystone says it blocked the unauthorized access, fixed the vulnerability, opened an investigation and began emailing affected customers. It promised a more detailed report but has not disclosed how many people were affected, when the unauthorized access began, what technical weakness was used or which order dates were included. Its reference to Shopify API activity describes how the company says it confirmed the incident; it does not by itself show that Shopify's core platform was breached. No independent forensic report was publicly available when this article was verified.

Questions over the 180-day deletion promise

The incident has also renewed scrutiny of Keystone's public data-retention claims. Its Privacy Promises page says all shipping information is automatically deleted 180 days after an order, while an older privacy policy and help-center guidance describe the process differently. The Block reported that several customers said they received breach notices for orders older than 180 days, but the outlet could not independently verify those accounts and Keystone had not publicly answered whether older order data remained in the affected system. Until the company publishes the promised report, the scope of the breach and any conflict with its deletion representations remain unresolved.

What affected customers can do

Customers who receive a notice should treat unsolicited messages about Keystone orders as potentially hostile, navigate to the company's website directly and verify support requests through an official channel. They should never disclose a recovery phrase, even to someone who can quote accurate order details. The available evidence points to a customer-data incident rather than a wallet-key compromise, but that personal information can make social-engineering attempts more convincing and warrants continued caution.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.