Cryptocurrency hardware wallet manufacturer Keystone has disclosed a security breach affecting its online store, exposing customer names, contact information, shipping addresses and purchase records.
The company detected unauthorized access to its official website on October 20, 2026, and confirmed on October 23 that an unidentified third party had obtained customer information after reviewing application programming interface activity with Shopify.
Keystone publicly disclosed the incident on October 24, acknowledging that the exposed records included purchased products and their prices. The company said payment card information, bank details, wallet recovery phrases, private keys and passwords were not compromised.
However, Keystone has not disclosed how many customers were affected, the geographical distribution of the exposed records or the method used to gain unauthorized access. The incident has also raised questions about Keystone’s data retention practices after several customers reported receiving breach notifications for purchases made more than 180 days earlier.
Customer Information Exposed Through Online Store
Keystone manufactures hardware wallets designed to store cryptocurrency private keys offline, reducing exposure to attacks targeting internet-connected devices. The latest incident involved its e-commerce infrastructure rather than a confirmed compromise of the wallets themselves.
According to Keystone, attackers obtained customer shipping and order information from its Shopify-powered storefront. The company said it blocked unauthorized access, addressed the vulnerability, opened an investigation and began notifying affected customers by email.
It also promised to publish a detailed incident report. Although private keys and recovery phrases were reportedly unaffected, the exposure of personal information creates risks for cryptocurrency holders.
Attackers possessing customer names, addresses and purchase histories could construct convincing phishing messages impersonating Keystone support representatives. Such messages might offer fraudulent refunds, replacement devices or security updates designed to trick recipients into revealing sensitive credentials.
Shipping addresses also present potential physical security concerns because they can associate identifiable individuals with cryptocurrency self-custody devices. Security researcher Taylor Monahan warned that this information could increase exposure to targeted threats, including physical coercion.
However, there is currently no verified evidence that the Keystone breach has resulted in cryptocurrency theft or physical attacks. Keystone has advised customers to avoid unexpected links and never disclose recovery phrases or private keys to anyone claiming to represent the company.
Data Retention Policy Faces Scrutiny
Beyond the immediate security incident, Keystone faces questions concerning its previous commitments to customer privacy. The company had publicly promoted a policy under which shipping information would be permanently deleted 180 days after an order.
In January 2026, Keystone highlighted that commitment while discussing customer data protection in the hardware wallet industry. However, several customers subsequently claimed that information associated with older purchases had been exposed.
One customer reported receiving a notification concerning an order placed more than two years earlier, while another described a purchase made 214 days before the breach. These accounts have not been independently verified, and Keystone has not established whether its deletion policy was breached.
The company’s published privacy materials also contain differences in how the retention period is described, complicating interpretation of the policy. Keystone’s investigation may clarify whether historical customer records remained accessible through Shopify or connected services.
The incident follows other reported hardware wallet customer-data breaches during 2026. In August, Trezor disclosed a breach involving shipping partner ShipMonk, initially affecting nearly 14,000 customers before identifying additional exposed records.
SafePal also reported an order-tracking vulnerability affecting approximately 40,000 customers. These incidents demonstrate that hardware wallet security extends beyond cryptographic protection to customer information collected during purchases and deliveries.
For Keystone, the immediate priorities are establishing the breach’s scope, explaining its data retention practices and preventing further unauthorized access. Until its detailed report is published, the number of affected customers and the full circumstances of the intrusion remain unknown.
