Keystone hardware wallet website breach exposes customer shipping and order data

Keystone, a hardware wallet maker, disclosed on October 24, 2026 that a third party accessed its official website without authorization. The company says it detected the unauthorized access on October 20 and confirmed on October 23, after checking API activity with Shopify, that the third party obtained customer shipping information. The exposed data covers names, contact details, shipping addresses, and order details, including items purchased and prices. Keystone says payment card and bank details, recovery phrases, private keys, and wallet passwords were not exposed. The company has not said how many customers are affected, so this is prepared as a Cybersecurity item, not a Breaches add, following the PwC and Railway precedents on this page: no confirmed record count is stated.

Keystone says it has blocked the access, fixed the vulnerability, and opened an investigation, and that it is emailing affected customers, with a detailed report promised. It warned that scammers may impersonate Keystone by phone, text, email, or mail, offering refunds, replacement devices, or help with an order or address, and stressed that it never asks for recovery phrases or private keys.

Update, October 27: Keystone said in an October 26 update that the attacker, who gained access through a flaw in a third party data monitoring tool and escalated privileges, also stole the WebAuth root key the company uses to verify that devices are genuine. The key is burned into devices during production and cannot be rewritten, so a counterfeit device carrying it could pass the online authenticity check. Keystone will destroy 18,835 unsold devices carrying the key, has suspended shipments, and will use a new key in new devices. The company now states a confirmed scale: 25,964 buyer records from 2024 to 2026, covering names, contact details, shipping addresses and order details, with another 12,873 unpaid checkout records included in its response as a precaution. Some records had been kept past the company's 180 day deletion policy after an automated deletion tool failed without the failure being noticed; Keystone is cutting retention to 90 days. Recovery phrases, private keys and payment data were not involved. A device delivered before October 20 that passes authentication can be used normally; a device received after October 20 with the old key should not be used until Keystone confirms it is genuine, and owners do not need to move funds because of the breach alone. The confirmed count remains below the scale tracked in the Breaches dashboard, so this stays a Cybersecurity update and no dashboard cascade applies.

Sources: Crypto Briefing; CoinLab; CoinDesk; The Hacker News