Key Takeaways
Customer records leaked, not wallet secrets. Keystone says a third party took names, contact details, shipping addresses, and order details from its Shopify store. It says recovery phrases, private keys, wallet passwords, and payment details were not exposed.
The main risk is targeted scams. Someone who knows your name, address, and which wallet you bought can pose as Keystone by email, text, phone, or post. The goal is almost always to get your recovery phrase.
One rule blocks most of these attacks. Never type, say, scan, or photograph your recovery phrase for anyone, and never set up a device you did not order yourself.
What Happened: The Timeline
Keystone makes air-gapped hardware wallets, devices that sign crypto transactions without connecting to a computer by USB, Wi-Fi, or Bluetooth. Its online store runs on Shopify, a widely used e-commerce platform.
Date (2026) | Event |
|---|---|
October 20 | Keystone detects unauthorized access to its official website |
October 23 | After reviewing API activity with Shopify, Keystone confirms a third party obtained customer shipping information |
October 24 | Keystone discloses the breach publicly on X, apologizes, and warns about impersonation scams |
After disclosure | Keystone says it is emailing affected customers and will publish a detailed report |
Keystone says it has blocked the access, fixed the vulnerability, and opened an investigation. As of October 26, 2026, it has not said how many customers were affected, how the attacker got in, or who was responsible.
What Was Exposed and What Was Not
The table below reflects Keystone's own statement.
Data type | Status according to Keystone |
|---|---|
Customer names | Exposed |
Contact details (email, phone) | Exposed |
Shipping addresses | Exposed |
Order details (items bought and prices paid) | Exposed |
Payment card or bank details | Not exposed |
Recovery phrases | Not exposed |
Private keys | Not exposed |
Wallet passwords | Not exposed |
Why the keys were never at risk: A hardware wallet creates its private keys on the device itself. The company that sells the device never sees them. A store database can hold your address, but it cannot hold your keys. Your funds stay safe as long as you never give your recovery phrase to anyone.
Why a "Shipping Data" Leak Still Matters
It is tempting to treat this as a minor leak. For hardware wallet buyers, it is more serious than a typical retail breach, for three reasons.
It identifies you as a crypto holder. An order for a hardware wallet suggests you own digital assets worth protecting.
It makes scams believable. A message that quotes your real name, address, product, and price looks far more authentic than a generic phishing email.
It links an online identity to a physical location. That raises privacy concerns beyond the internet, which we cover below.
The 180-Day Deletion Question
Keystone has promoted a data policy stating that shipping data is deleted 180 days after an order. The Block reported on October 25 that some customers say they received breach notices for orders older than that, including one person who said they ordered more than two years ago.
These customer claims have not been independently verified. The Block also noted that Keystone's privacy policy and help pages describe the rule in slightly different ways, and that some records, such as city and country, are not deleted. Keystone had not publicly addressed the question at the time of writing. Its promised detailed report may clarify it.
The lesson for any buyer: a deletion promise reduces risk only if it is applied fully, including at the third-party platforms that store order data.
This Is Not the First Hardware Wallet Data Leak
Customer data leaks have hit several wallet makers. In most cases the breach happened at a partner, such as an e-commerce, support, shipping, or email provider, not inside the wallet itself.
Date | Company | What happened | What followed |
|---|---|---|---|
2020 | Ledger | E-commerce database leak; data on about 272,000 customers and over 1 million emails was later dumped online | Years of phishing, threatening messages, and fake mail |
June 2021 | Ledger customers | Criminals mailed altered Nano X devices with a letter citing the 2020 leak | Device asked users to run software and enter their recovery phrase |
January 2024 | Trezor | Third-party support portal breached; up to 66,000 contacts exposed | Fake support emails asking for recovery phrases |
January 2026 | Ledger | Leak at e-commerce partner Global-e exposed names, addresses, and order details | Phishing warnings to customers |
February 2026 | Trezor and Ledger users | Fake letters with QR codes demanding a "mandatory check" | QR code led to a page asking for the recovery phrase |
August 2026 | Trezor | Shipping provider ShipMonk breached through a flaw in analytics tool Metabase; about 14,000 customers affected | Warnings of fake emails, calls, and letters |
September 2026 | Trezor | Email provider Brevo compromised; phishing sent to about 347,000 newsletter addresses | About 2,500 users reportedly clicked before the link was taken down |
October 2026 | Keystone | Shopify store access exposed names, contacts, addresses, and orders | Keystone warns of impersonation scams |
The pattern is consistent. Leaked contact data is used for months or years after the original breach.
Scams Keystone Customers Should Expect
Keystone named the main scam themes in its own warning: refunds, replacement devices, and "fixes" for an order or address. Here is how they usually look.
Scam type | What it looks like | Safe response |
|---|---|---|
Fake security email | "Your wallet was affected by the breach. Verify now." | Do not click. Type keyst.one into your browser yourself |
Fake refund or compensation | A link to claim money for the breach | Real refunds never require a recovery phrase |
Replacement device in the mail | A "new, safer" wallet arrives with a letter | Do not set it up. Contact Keystone through official channels |
Letter with a QR code | A printed notice demanding an urgent "check" | Never scan it or enter your phrase on any page |
Phone or text impersonation | A caller who knows your order details | Hang up. Detailed knowledge is not proof of identity |
Fake police or authority call | A spoofed number claiming an investigation | Hang up and call the agency using a number you look up yourself |
One customer told The Block they received a call from a number spoofing a Montreal police line, with details that matched a 2024 Keystone order. That report is unverified, but it shows how leaked details can be used.
What to Do If You Are a Keystone Customer
These are general safety steps for education, not financial or legal advice.
Confirm your status through official channels. Look for Keystone's email, but do not click links in it. Visit keyst.one directly or write to support@keyst.one.
Keep your recovery phrase offline. It should only ever be entered on your own hardware wallet during a genuine recovery that you started.
Reject any device you did not order. Keystone specifically warns never to enter your recovery phrase into a device you did not buy.
Treat every unexpected contact as suspicious. Email, text, phone, social media DMs, and paper mail are all possible channels.
Watch for related attacks. Expect fake messages that copy the breach news itself, such as "breach compensation" offers.
Reduce your public footprint. Consider not discussing crypto holdings publicly, and consider a PO box or delivery locker for future crypto-related orders.
Report attempts. Forward scam messages to Keystone and report them to your local cybercrime authority.
If you ever shared your recovery phrase, assume it is compromised. The standard practice is to create a new wallet with a new phrase on a trusted device and move your funds there quickly.
A Note on Physical Safety
Addresses linked to crypto purchases can also attract physical threats. Security firm CertiK counted 72 verified "wrench attacks" in 2025, meaning robberies or kidnappings aimed at forcing victims to hand over crypto. It reported that this was up 75% from 2024.
The risk to any single customer is low, but simple habits help: keep holdings private, avoid displaying hardware wallets publicly, and contact local police if you feel targeted.
What We Still Do Not Know
How many customers were affected
How the attacker gained access to the Shopify store
Whether the 180-day deletion policy was applied to all past orders
Whether the stolen data has been sold or published
Keystone says a detailed report is coming. We will update this article when it is released.
FAQ
Did the Keystone data breach expose recovery phrases or private keys?
No. Keystone says recovery phrases, private keys, wallet passwords, and payment details were not exposed. A hardware wallet maker does not store these secrets.
What data was stolen in the Keystone breach?
Keystone says names, contact details, shipping addresses, and order details, including items purchased and prices paid, were obtained by a third party.
Are my funds at risk if I own a Keystone wallet?
Your funds are not directly exposed by this leak. The risk comes from scams that try to trick you into revealing your recovery phrase or setting up a fake device.
Will Keystone send me a replacement device?
Keystone warns that offers of replacement devices are a common scam and says none of these messages come from them. Verify anything unexpected through keyst.one or support@keyst.one.
How do I know if I was affected?
Keystone says it is emailing affected customers. Do not click links in any breach email. Contact Keystone directly using its official website.
Related Terms
Hardware Wallet: A physical device that keeps crypto private keys offline and signs transactions without exposing them to the internet.
Recovery Phrase: A list of 12 to 24 words that can restore a crypto wallet and every key it controls.
Air-Gapped Wallet: A wallet that never connects directly to a computer or network and passes data through QR codes or memory cards instead.
Phishing: A scam in which an attacker poses as a trusted company or person to steal passwords, recovery phrases, or money.
Wrench Attack: A physical attack in which criminals use threats or violence to force someone to hand over their crypto.
Sources
Keystone Hardware Wallet (@KeystoneWallet), breach disclosure posted on X (October 24, 2026): https://x.com/KeystoneWallet
The Block, "Keystone customers say breach exposed data the hardware wallet maker promised to delete" (October 25, 2026): https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613
Crowdfund Insider, "Keystone Hardware Wallet Alerts Users After Security Breach Exposes Shipping and Order Records" (2026): https://www.crowdfundinsider.com/2026/10/320546-keystone-hardware-wallet-alerts-users-after-security-breach-exposes-shipping-and-order-records/
Ledger, update on data protection efforts and the Shopify incident (2021): https://ledger.com/blog/beta-testers-ama-demystifying-the-data-breach-with-matt-johnson
BleepingComputer, "Criminals are mailing altered Ledger devices to steal cryptocurrency" (June 2021): https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency
Trezor, "Trezor security alert: Stay vigilant against a potential phishing attack" (January 2024): https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8
SiliconANGLE, "Ledger confirms leak of customer data from third-party Global-e hack" (January 2026): https://siliconangle.com/2026/01/05/ledger-confirms-leak-customer-data-third-party-global-e/
BleepingComputer, "Snail mail letters target Trezor and Ledger users in crypto theft attacks" (February 2026): https://bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks
BleepingComputer, "Trezor discloses data breach affecting nearly 14,000 customers" (August 2026): https://bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers
BleepingComputer, "Trezor: 347,000 users targeted in phishing attacks after Brevo breach" (September 2026): https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
Decrypt, "$41M in Losses as Crypto Wrench Attacks Hit Record High in 2025" (citing CertiK): https://decrypt.co/356604/41m-in-losses-as-crypto-wrench-attacks-hit-record-high-in-2025
