Keystone Hardware Wallet Website Breach Exposes Customer Order Data, Seed Phrases Unaffected

Keystone, the maker of air-gapped hardware wallets, has disclosed that an unauthorized intrusion into its official website exposed customer order records, including names, details, shipping addresses and purchase histories. The company said the cryptographic secrets stored inside its devices were not affected.

The breach was detected on October 20, 2026, and confirmed three days later after a review of activity on the Shopify application programming interface that runs the company's online store, according to a disclosure published October 24. Keystone said it has since blocked the intrusion, patched the vulnerability that allowed it and opened an investigation.

Keystone has not said how many customers were affected, who was behind the intrusion, how the attacker gained entry or how long unauthorized access persisted. The company said it is notifying affected buyers by email and will publish a fuller incident report, without giving a date.

Note: Based on Keystone's October 24 disclosure. The company has not specified the number of affected customers or the exposure window.

The distinction between website systems and device-held keys is central to the disclosure. A recovery phrase is the master credential from which a wallet's private keys are derived, and its exposure would put funds at risk directly. Keystone's wallets sign transactions offline and communicate through QR codes, a design intended to keep key material away from internet-connected servers. The company has not provided technical detail on how its website environment is separated from the device.

The exposed records tie specific device purchases to identifiable buyers, a combination that carries its own risks. Keystone warned customers fraudulent refund offers, replacement-device schemes and messages purporting to offer order assistance, delivered by email, phone, text message or post. It advised users never to recovery phrases or private keys, never to enter a phrase into an unexpected replacement device and to verify any communication through official channels.

The incident adds to a run of customer-data exposures at hardware wallet sellers. In August, Trezor disclosed a breach at shipping provider ShipMonk and later identified roughly 67,000 additional affected customers in the United States. SafePal disclosed an order-tracking authorization flaw affecting 39,798 customers. In each case the compromised information sat in ordering or fulfilment systems rather than in the wallet signing mechanism.

Keystone's disclosure follows separate security trouble at rival Ledger, which is investigating the loss of user assets from devices bought through a Southeast Asian reseller and has asked that reseller to suspend sales and shipments as a precaution.

For hardware wallet owners, the practical exposure from a web-database breach differs from an exchange failure. Coins held on a device whose recovery phrase was generated offline and never typed into a web form are not reachable through a manufacturer's website. The danger lies in what the leaked data enables: phishing built on real order details, and targeted social engineering against buyers whose holdings may be inferred from their purchases. Security specialists have long argued that a wallet's supply chain and customer database are separate attack surfaces from the device itself, and that a compromise of the former can precede an attempt on the latter.

Keystone users should treat any unsolicited message referencing an order as suspect until the company publishes its full report. A complete account would normally set out the categories of data taken, the period of unauthorized access, how the intrusion was discovered and what notifications have been sent, since data protection rules in several jurisdictions impose deadlines for informing affected individuals.

The assurance that private keys and recovery phrases remain secure addresses the most severe outcome, the direct loss of funds, but it does not cover harm that can follow from leaked personal information. Bitcoin's base layer is unaffected by the operational security of any wallet vendor.