Keystone data breach: customer addresses exposed

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Hardware wallet maker Keystone disclosed on Saturday that its own web shop had been broken into. Names, details, delivery addresses and order details of customers were taken. Recovery phrases, private keys and payment data are not affected, according to the company. If you bought from Keystone, that means your balance is not at risk from this incident, but your address and the fact that you own a hardware wallet very much are.

That distinction is important, and it decides what makes sense now and what will land you in more trouble. The most dangerous response to a notice like this is a hasty one. Anyone who panics and resets their device, moves coins somewhere unfamiliar or goes along with a supposed replacement programme does not lose their money to the original breach in the end. They lose it to the wave of fraud that follows.

What Keystone disclosed: access on 20 October, confirmation on the 23rd

Keystone noticed the unauthorised access to its company website on 20 October 2026, by its own account. After reviewing API activity at Shopify, the maker's shop provider, the company confirmed on 23 October that a third party had obtained customer shipping data. Keystone made the incident public on 24 October through its channel on X.

The post opens with a sentence companies rarely put so plainly after a data breach: "We owe you an apology" . Keystone goes on to say it has blocked the access, closed the exploited vulnerability, launched an investigation and begun notifying affected customers by email. A detailed report has been announced.

Several central details are still missing. Keystone names neither the number of customers affected, nor the period the stolen orders come from, nor the route the attacker took in. There is no country breakdown either, and therefore no answer to how many European buyers sit in the data set. Anyone wanting to know whether they are included depends for now on the company's notification. The maker's statement is the only primary source on any of this.

This data was taken, and this was not, according to the company

On Keystone's account, the data set covers names, details, delivery addresses and order details, meaning the items purchased and the prices paid. That last part is not a side issue: the model ordered reveals which device someone uses, and the price reveals how much they invested.

Explicitly not affected, the maker says, are credit card and bank data, recovery phrases, private keys and device passwords. That statement comes from the company itself and has not been independently verified so far; Keystone has not produced a third-party forensic report.

The claim is nonetheless technically plausible, for a straightforward reason.

The recovery phrase still only lives on the device

A hardware wallet is a device that generates and stores your private keys without ever handing them to a computer or to the network. A transfer is signed on the device itself, and only the finished signature leaves it. The maker learns nothing your keys because it never receives them. How that works in detail is set out in our explainer on what a hardware wallet actually does .

What a web shop knows the device

A maker's web shop is completely separate from that machinery. It processes orders, meaning address, item, price and shipping status. Between the shop system and the chip in the device there is no connection an attacker could use to reach keys from a customer database. Hence the principle that should govern every response to this incident: a data breach at the retailer is a privacy incident, not a wallet incident. You do not need to reset your device, create a new wallet or move any balance.

The Shopify API: what the reference says and what it does not

Keystone cites the review of API activity at Shopify as the route by which the scope of the breach was established. That reference is easily misread. It says the shop platform's logs showed which data was retrieved. It does not say that the Shopify platform itself was compromised, and Keystone makes no such claim.

An interface through which a shop system hands out order data is an ordinary tool for the operator. It is secured with access keys and often opened up to add-on apps that handle shipping, marketing or accounting. Where such a key falls into the wrong hands, or a connected add-on is itself attacked, the records can be drained without anyone breaking into the shop. Which of those routes was taken here, Keystone has not yet said.

The four scams Keystone itself warns

The maker sets out fairly precisely what those affected now have to expect. Criminals pose as Keystone, by email, phone, text message or post. What they offer is refunds, free replacement devices and help with a supposedly faulty order or delivery address. The company states clearly that it never asks for a recovery phrase or a private key.

The most dangerous of these is the replacement device. The scam works because it looks like goodwill: a parcel arrives containing a device and a note saying the old model was affected by the incident and the new one is already set up. Anyone who uses the enclosed recovery phrase, or enters their own into an unfamiliar device, hands over control of their balance. That is why the rule holds without exception: a recovery phrase never goes into a device you did not order yourself, and never into a website or a form. We collected the typical warning signs in such messages after earlier cases, in the overview of phishing after a data breach .

The inclusion of post in that list is what separates this from an ordinary email leak. A letter with the correct address, the right order date and the matching model name feels real because it looks real. The details that make it credible come from the data set.

The delivery address is the real damage

An email address can be changed. A address cannot, at least not without moving. That is why security specialists speak more bluntly leaks at mail-order sellers of crypto devices than other data breaches.

Security developer Taylor Monahan, known in the industry as Tay, has pointed out, according to reports by crypto.news , that shipping data of this kind can expose buyers to physical threats, up to robbery and kidnapping. The industry term for this is a wrench attack: an attack that does not go after the encryption at all, but after the person who knows the key. There is no evidence so far that the data stolen from Keystone has already led to physical attacks.

The sober assessment: the data set contains one piece of information that an address list from any other online shop does not. It links an address to the statement that someone living there holds crypto assets in self-custody and spent money doing so. Anyone who has had devices delivered to their address has a reason, after this incident, to handle that differently in future, via a parcel locker or a delivery address that is not the . For choosing a device, that is now a criterion alongside the technical ones: our hardware wallet comparison sets out which makers ship by which routes.

How large the damage is depends on how long Keystone keeps order data at all. There are two public statements from the company on this, and they do not match.

Whether the data set really contains only orders from the last 180 days is therefore open. Keystone has not committed itself on the point when asked on social media, pointing instead to the running investigation and the announced report. Whether the January pledge was kept cannot be established as things stand, and no such assessment is made here.

Yanssie HK Limited in Hong Kong: who stands behind the brand

In practice: your rights exist, but the path to them is longer than with a provider that has an establishment in the EU. Anyone who wants to avoid that cannot dodge the basic question of how much to hold themselves and how much to leave with a supervised provider. Which houses operate under supervision is shown in the overview of regulated crypto exchanges .

Access under Article 15, compensation under Article 82

Two claims matter for those affected in Europe. Article 15 of the General Data Protection Regulation gives you the right to learn what data a company holds you. In this incident that is the only reliable way to settle the question Keystone left open: which period your orders still cover, and what of that sat in the data set. The request goes to the company's support address, it needs no particular form and it is free.

Article 82 governs compensation. Germany's Federal Court of Justice ruled on 18 November 2024, in the proceedings on the data breach at the social network , case number VI ZR 10/24, that the mere loss of control over one's own data can constitute non-material damage. Under the headnotes, neither a misuse of the data need have occurred nor must further tangible adverse consequences be added. Those proceedings concerned a data set of 533 million entries worldwide, including around six million people in Germany.

On the amount the judgment says little that generalises. What counts under the case law includes the sensitivity of the data concerned, the nature and duration of the loss of control, and whether control can be regained. There are no reliable figures for a case like this one, and anyone who quotes you a sum before the scope and period of the breach are settled is working with a number nobody yet knows. That a claim exists in principle is, after the Federal Court of Justice decision, no longer the contested question it was before 2024.

Trezor, SafePal, Ledger: the shipping route is the weakest link

The case joins a run that has become conspicuously dense in 2026, and the pattern is the same every time: every time the cryptography of the devices holds, and every time the chain of shop system, logistics provider and connected add-ons gives way.

Trezor reported a breach via logistics provider ShipMonk in August, initially covering 13,689 customers; in early September the company said around 67,000 further US customers with orders from the years 2019 to 2021 were added. What those affected could do is written up in our piece on the Trezor data breach . SafePal named 39,798 affected customers in the same month, taken via an embedded shipment-tracking add-on. The oldest and best known case remains Ledger: after the 2020 incident, around 272,853 records with addresses became public, along with some one million email addresses.

The Trezor follow-up disclosure in September shows exactly the problem now hanging over Keystone: orders from 2019 to 2021 sat in a data set there, although the provider had previously confirmed in writing that old data had been deleted. A promised deletion period is worth only as much as its implementation at every provider that ever saw the data.

For the trade-off between self-custody and third-party custody, that changes little. Key sovereignty remains the strongest argument for owning a device, and none of these incidents has ever led to a loss of balance through the device itself. What changes is the realisation that buying a security device itself leaves a data trail you have to factor in.

Keystone data breach: the seed is safe, the delivery address is not

For owners of a Keystone device, a manageable order of business follows.

Change nothing on the device. No reset, no new recovery phrase, no moving of the balance. The incident concerns the shop system, not the keys. If you are thinking changing devices anyway, the hardware wallet comparison is the place for that, not an email offering you a replacement.

Treat every approach as fake until the opposite is established. Click no links from messages, use no callback numbers from emails, enter no recovery phrase. Reach the maker through its website address typed in yourself. If you want to hold less yourself as a matter of principle, check the supervised providers in the overview of regulated crypto exchanges instead.

Request access under Article 15 and wait for the report. An informal email to support settles which order data is still stored. Wait for the company's announced detailed report before you consider going further. If you are also weighing whether to keep smaller amounts off a device entirely, the alternatives are in the software wallet comparison .

The one figure still missing from this incident is the number of people affected. Until Keystone names it, every buyer has to assume they are among them.

(As of October 25, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions the Keystone data breach

No. According to Keystone, recovery phrases, private keys and device passwords were not taken. What was affected are names, details, delivery addresses and order details from the web shop. You therefore do not need to reset your device or move any balance.

On the company's account, names, details, delivery addresses and the order details with items purchased and prices paid were taken. Payment and bank data are not affected, Keystone says.

Keystone is notifying affected customers by email and has named neither a number of people affected nor the data period. Certainty comes from an access request under Article 15 GDPR to the company's support address, which needs no particular form and is free.

A wrench attack is an attack that does not overcome the encryption but goes after the person who knows the key, for instance through robbery or coercion. Because the Keystone data set links addresses to ownership of a hardware wallet, security developer Taylor Monahan pointed to this risk. There is no evidence of such attacks following this leak so far.

Germany's Federal Court of Justice ruled on 18 November 2024 that the mere loss of control over one's own data can constitute non-material damage under Article 82 GDPR, case number VI ZR 10/24. On the amount the judgment says little that generalises; it depends among other things on the sensitivity of the data and the nature and duration of the loss of control.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

Trezor Data Breach: First 13,689 Customers, Then Roughly 67,000 More Exposed

Revolut data breach: the bank pays for new ID documents for 680 customers, and what you can do now

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email

Crypto Wallet Provider Ledger Hacked: Data Leak Results in Phishing Scams

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

September 4, 2026 10:15 PM

Trezor Data Breach: Am I Affected and What Should I Do Now?

Trezor widened the ShipMonk data breach on September 4, 2026: around 67,000 further people affected, just over 80,000 in total, from orders placed between November 2019 and August 2021. How to check in two minutes whether you are among them, and what an exposed address means for self-custody.

October 11, 2026 4:50 AM

90 Crypto Kidnappings and Robberies in 7 Months: Why France Is the Most Dangerous Country for Bitcoin Holders

France logged 90 crypto kidnappings, extortions and violent thefts this year, one every 2.5 days. Leaked tax data is to blame. Here is how to protect yourself.

December 26, 2025 1:50 PM

Breaking: Trust Wallet Chrome Extension Hack Drains $7M, Full Reimbursements Promised

A supply-chain attack hit Trust Wallet’s Chrome extension, draining $7M from users. Binance’s CZ says all victims will be reimbursed.

October 9, 2026 5:36 PM

Ledger Hack? $86 Million Drained: What Is Behind the Tampered Wallets From Southeast Asia

Since Friday, Ledger users in Southeast Asia have been reporting empty wallets, and analysts count more than $86 million. Ledger has halted the reseller CryptoBilis. An implant inside the device reportedly reads the seed phrase. What is known, what CZ advises and what you should do now.

August 25, 2026 10:31 PM

Crypto Wallet Phishing by Letter: Why the QR Code From Your Postbox Wants Your Recovery Phrase

Letters carrying a QR code urge a supposedly urgent wallet update on grounds of quantum resistance and lead to a page that asks for the recovery phrase. The Federal Office for Cybersecurity reported the ploy on August 18, 2026.

September 12, 2026 4:12 PM

Revolut Data Breach: Am I Affected, and What My Bitcoin History?

After a forged government request, Revolut handed identity documents, account statements and complete Bitcoin transaction histories to an unauthorised party. Here is how to establish whether you are affected, and which protective measure actually achieves anything in this case.

September 10, 2026 1:14 PM

Phishing Email From the Real Sender Address: How to Check a Wallet Security Warning

An alleged security warning to wallet customers travelled through the manufacturer's genuine sending channel and passed every technical authenticity check. The test that still holds costs you four minutes.

October 23, 2026 10:21 PM

Ngrave phishing: $2.56 million left 70 wallets after a hijacked push provider

Attackers hijacked the push provider of Belgian hardware wallet maker Ngrave and sent fake security alerts to users of the LIQUID app on October 17. Anyone who entered their recovery words lost their balance: between $2.56 million and $2.65 million flowed out, while the devices themselves remained untouched according to the company.

September 14, 2026 10:11 PM

Revolut Data Breach: Your Files Are Public, and Here Is What You Can Do

Since September 14, the ID copies, KYC selfies and account statements stolen from Revolut have been published. What a password change no longer achieves, which rights the GDPR gives you, and why your Bitcoin history is the most sensitive part of the package.

September 10, 2026 9:13 AM

Trezor Hack Scare: That STM32 Entropy Email Is a Phishing Attack

Trezor users received a fake STM32 entropy warning sent from a real Trezor address. Here is what happened and what to do if you clicked.

September 15, 2026 3:53 PM

Waltio Confirms Brevo Breach Touched Its User Emails: Here Is What To Do Now

Waltio has told users its Brevo account was accessed during the September breach that also hit Trezor and BitBox. Here is what was exposed.

September 1, 2026 7:27 AM

Clipboard Attack: How Malware Swaps the Wallet Address You Copied

A clipper replaces the receiving address between copying and pasting with the attacker’s, and your wallet’s checksum notices nothing. What Microsoft and the Federal Office for Cybersecurity have documented, and which check really makes the attack come to nothing.

October 18, 2026 4:18 AM

Trezor cuts its authorized dealers: the authorizations end on January 1, 2027

After the supply chain attack on Ledger devices, Trezor is shrinking its dealer network and ending the authorizations on January 1, 2027. Until then, dropped partners may sell down their remaining stock, so the whole Christmas season still falls under the old list.

October 16, 2026 4:41 PM

Fake Ledger firmware updates: SlowMist reports phishing pages with a replica Genuine Check

A phishing campaign reproduces the sequence of an official Ledger update and asks, at the end, for the 24 recovery words. SlowMist reported it on October 16; Ledger had set out its reading of the underlying implant case a day earlier.

October 13, 2026 1:16 AM

Ledger Confirms Implant in a Hardware Wallet as Reports Reach Europe: What Is Behind It

Ledger confirms an unauthorised additional circuit board in a tampered device and traces the confirmed cases to a reseller in South-East Asia. One report from European retail is still open, which makes the purchase route of your own device the criterion.

October 10, 2026 10:35 PM

Fake Ledger Site Tops Google : “Once the recovery phrase has been handed over, the wallet must be regarded as compromised”

A security researcher reports a rebuilt Ledger site high up in Google's results that asks for the 24-word phrase. Running alongside it are emails with an invented deadline of October 15.

Microsoft Hackers Stole Crypto Using Victims Emails

Another batch of crypto users have lost money recently through an unlikely breach. Recently, Microsoft services such as Hotmail, MSN, and Outlook have been hit by a breach. It was later learned that the breach was due to an employee’s […]

October 14, 2026 1:30 PM

What is a hardware wallet? How the device protects your keys

A hardware wallet stores no coins, only the private key, and it never releases it. How signing works inside the device, what the 12 or 24 words mean, and which attacks the design cannot stop.

September 4, 2026 10:26 PM

Pocket Bitcoin Data Breach: When Name, Address and Bitcoin Address Circulate Together

The Swiss Bitcoin service Pocket Bitcoin closed its investigation on September 3, 2026: 5,411 people affected, and for 291 of them the Bitcoin addresses they used along with copies of identity documents. Why this one data pairing has lasting effect, and what you should check with your own provider.

September 23, 2026 4:12 AM

How to Set Up a Crypto Wallet: Securing Your Coins in Seven Steps

Your own crypto wallet is set up in twenty minutes, yet a single step decides everything that follows. This guide takes you through wallet type, recovery words and the test amount, and sets out what BaFin and the tax office expect.

August 20, 2026 4:24 PM

Bitcoin Across Multiple Wallets: How Austria Works Out the Acquisition Cost

Bitcoin spread across several wallets? How Austria works out the acquisition cost and the rolling average price for tax purposes.

October 19, 2026 1:14 AM

Qubic halts its mainnet after 1,404 wallets are drained: the seed was the weak point

An attacker drained 1,404 Qubic wallets on the night of October 18, roughly $1.3 million. The protocol was not to blame: seed generation in the browser supplied too little randomness.

October 2, 2026 10:36 AM

Hot Wallet or Cold Wallet: the Private Key Decides How Safe Your Coins Are

Hot wallet or cold wallet: the difference rests solely on whether the private key is online. What separates the two forms, where the limits of hardware lie and why moving to your own device triggers no tax.

September 30, 2026 7:16 AM

Tangem Wallet: The Card Without a Seed Phrase vs the Classic Hardware Wallet

The Tangem Wallet secures crypto with two or three identical cards instead of 24 words. What the sets cost, what the EAL6+ chip delivers and why losing every card is final.

August 22, 2019 9:55 AM

Here’s why you should skip ’s Crypto: Instagram Data Breach

It’s practically similar to stating the sky is blue yet we have another Data Leak close by influencing a huge number of clients. This time around, it includes the data of in excess of 49 million Instagram Accounts […]

October 25, 2026 3:31 PM

Electrum wallet vulnerable before version 4.8.3: what you can do now

Electrum released version 4.8.3 on October 23, 2026 and closed a flaw that malicious servers had already exploited. It does not harvest your keys; it targets the moment you speed up a stuck transaction.

October 22, 2026 4:17 PM

Railway hack hits crypto bots and wallets: what to check and replace now

US host Railway reports possible access to its customers' secrets. For crypto bots and wallets that is particularly dangerous: analysts already count outflows of around $371,000.

More from CryptoTicker