Keystone, a maker of cryptocurrency hardware wallets, detected unauthorized access to its official website on October 20, 2026. On October 23, while reviewing API activity on Shopify, its store platform, the company found that a third party had exfiltrated customer data.

It disclosed the incident on October 24 via X, opening with the statement "We owe you an apology." The exposed data includes customer names, contact details, shipping addresses, and order records showing which products were purchased and at what prices.

Keystone says it has blocked the access route, fixed the exploited vulnerability, launched an investigation, and begun notifying affected customers by email. A detailed incident report has been announced but not yet published.

Keystone states that payment card details, bank account information, wallet recovery phrases, private keys and device passwords were not compromised.

The claim is technically plausible because a hardware wallet generates and stores keys on the device itself and never transmits them to the vendor, so an attacker draining an order database has no path to the keys.

However, the company's statement has not been independently verified, and no third-party forensic report exists yet. The practical reading: this is a privacy incident, not a wallet incident, and customers do not need to reset devices or move funds because of the breach itself.

The stolen order data links a home address to the fact that someone there holds crypto in self-custody and spent money doing so.

Security developer Taylor Monahan warned, according to reporting cited by CryptoTicker and MENAFN, that shipping data of this kind can expose buyers to physical threats including robbery — the industry calls this a "wrench attack."

CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up from 39 a year earlier, per Cointelegraph's reporting cited by MENAFN. Because the model purchased reveals which device someone uses, scammers can craft highly convincing tailored lures referencing real orders.

A surprising wrinkle: some customers who received breach notifications say they bought their devices more than two years ago, even though Keystone had advertised that shipping data is permanently deleted 180 days after an order.

CryptoTicker reports that Keystone's privacy policy dated July 7, 2026 actually ties the 180-day window to each customer's most recent order, meaning older orders can remain stored for repeat buyers. One user reported an impersonation call referencing a 2024 order.

Keystone has not responded in detail on whether it complied with its deletion policy, pointing instead to the ongoing investigation.

The incident joins a conspicuous run of customer data leaks in the hardware wallet industry. In August, Trezor said a leak at a shipping partner exposed information for about 14,000 customers, later finding another 67,000 US customers affected.

SafePal has said a flaw in its order lookup system exposed personal data for about 40,000 users. The pattern suggests the shipping and retail route — storefronts, order APIs and fulfillment partners — is the weakest link for wallet makers, even when the devices' key security holds.

Keystone has not yet said how many customers were affected, what countries they are in, or the exact attack vector.

Keystone warns that the stolen data could fuel impersonation scams offering refunds, free replacement devices or order changes, delivered by email, phone, text or even post — a letter with the correct address and order details can feel authentic.

The company says it never asks for a recovery phrase or private key. The most dangerous scam is a replacement device shipped with an "already set up" recovery phrase; entering your own phrase into an unfamiliar device hands over your balance.

Customers should ignore unsolicited refund or replacement offers, never enter recovery phrases into websites or forms, and await Keystone's promised detailed incident report.