The Keystone wallet breach exposed customer names, contact details, shipping addresses and purchase records from the cryptocurrency hardware wallet maker’s online store, the company disclosed on October 24, 2026.

Key Takeaways

  • Keystone said private keys, recovery phrases, passwords and payment information were not compromised.
  • The company has not disclosed how many customers were affected or how the unauthorized access occurred.
  • Some customers reported notifications for older orders, raising questions about a 180-day shipping-data deletion policy.

What the Keystone wallet breach exposed

Keystone detected unauthorized access to its official website on October 20 and confirmed on October 23, after reviewing application programming interface activity with Shopify, that an unidentified third party had obtained customer information.

The exposed records included products purchased and their prices. The incident involved the company’s e-commerce infrastructure, not a confirmed compromise of its hardware wallets, which are designed to keep cryptocurrency private keys offline.

Keystone said it blocked the unauthorized access, addressed the vulnerability, opened an investigation and began notifying affected customers by email. It has not disclosed the geographic distribution of affected records.

Older orders raise retention questions

Keystone had publicly promoted a policy of permanently deleting shipping information 180 days after an order. Several customers later reported receiving breach notifications for purchases older than that period, including one customer who cited an order from more than two years earlier.

Those accounts have not been independently verified, and Keystone has not established whether its deletion policy was breached. Its published privacy materials also differ in how they describe the retention period.

Risks for affected customers

Names, addresses and purchase histories could be used to make phishing messages appear credible or to identify people who own cryptocurrency self-custody devices. There is no verified evidence that the breach has resulted in cryptocurrency theft or physical attacks.

Keystone advised customers to avoid unexpected links and never disclose recovery phrases or private keys to anyone claiming to represent the company.

Next milestone

Keystone has promised to publish a detailed incident report; the scope and full circumstances of the intrusion remain unknown.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.