Keystone Breach Exposes Customer Addresses and Order Details

Hardware-wallet maker Keystone detected unauthorized access to its website on October 20 in what the company later confirmed as a Keystone breach. The breach exposed customer names, details, shipping addresses and order information. After reviewing API activity with Shopify, the company confirmed the exposure on October 23.

Those order records showed which products customers bought and how much they paid. Keystone blocked the access, fixed the vulnerability and began contacting affected customers, but did not disclose how many people were affected.

🎯 Customer records were exposed, not wallet credentials, Keystone says

📖 Red Flags: Shipping and order data could help scammers impersonate Keystone

📖 Keystone's 180-day data-retention policy faces questions

🟣 Earlier incidents affected Trezor customer records and Ledger distribution

🎯 Company begins customer outreach and investigation

Customer records were exposed, not wallet credentials, Keystone says

Keystone said the breach did not expose payment-card information, bank details, wallet passwords, recovery phrases or private keys. The attackers accessed customer-commerce records, and the company did not report any compromise of its wallet devices.

“You trusted us with those details, and we’re sorry we didn’t keep them safe,” Keystone said in its apology to customers.

Red Flags: Shipping and order data could help scammers impersonate Keystone

The exposed records give scammers material for convincing impersonation attempts. Keystone warned that customers may receive phone calls, texts, emails or physical mail offering refunds, replacement devices or supposed fixes to orders and addresses. Messages that include a customer’s name or purchase details may look legitimate even when they do not come from the company.

Dogecoin community member Mishaboar warned that shipping information could also help scammers target customers with phishing attempts. Buying a hardware wallet does not prove that someone currently holds cryptocurrency, but it gives an impersonator a specific pretext for making .

In a warning on X , Mishaboar urged customers not to reveal more information themselves or their families on social media. Citing earlier incidents involving Trezor and Ledger, he said scammers could also approach victims through physical mail.

Keystone told customers never to recovery phrases or private keys, enter a recovery phrase into a device they did not order, or click links in unexpected messages. The company said it will never ask for recovery phrases or private keys.

Keystone’s 180-day data-retention policy faces questions

Keystone has said it deletes customer information 180 days after an order in most cases. Following the breach, users on X questioned that claim.

The incident has put fresh scrutiny on how long the company keeps purchase and shipping records accessible.

Earlier incidents affected Trezor customer records and Ledger distribution

Earlier in the summer, a breach at Trezor logistics provider ShipMonk exposed names, emails, phone numbers, shipping addresses and order information. Trezor initially said more than 13,000 US customers were affected, but later disclosures pushed the total above 80,000, according to CryptoPotato .

Ledger disclosed a different type of attack earlier in October. Genuine devices sold through some Southeast Asian resellers had been fitted with hidden hardware capable of reading the 24-word recovery phrase during initial setup and transmitting it over an LTE connection. Ledger said its Secure Element, operating system and internal servers were not compromised, describing the incident as a localized distribution-channel attack. Initial reports connected the devices to more than $86 million in suspected thefts, though Ledger had not confirmed that figure.

Company begins customer outreach and investigation

Keystone is emailing affected customers while it investigates the breach. The company has promised a more detailed report but has not said when it will release one.

When did Keystone detect the website access and confirm the exposure?

Keystone said it detected the unauthorized access on October 20, 2026. After reviewing API activity with Shopify, it confirmed on October 23 that customer shipping information had been obtained.

What customer information was exposed?

The exposed records contained customer names, details, shipping addresses, order information, products purchased and prices paid. Keystone said the breach did not expose payment-card information, bank details, wallet passwords, recovery phrases or private keys.

What should customers do if a message offers a refund or replacement?

Keystone warned that scammers may use refund or replacement offers to impersonate the company. Customers should avoid links in unexpected messages, use official channels and refuse to sensitive information.

What does Keystone’s 180-day deletion statement cover?

Keystone has said it deletes customer information 180 days after orders in most cases. Users on X questioned that claim after the company disclosed the breach.

What happens after Keystone contacts affected customers?

The company says it is emailing affected customers and has opened an investigation. It has promised a fuller report but has not specified when it will publish it.

This article is for information only and is not financial advice.