Keystone Says Website Breach Exposed Buyers' Shipping Data

Hardware wallet maker Keystone says a third party obtained customer data through its official website. The company detected unauthorized access on Oct. 20, confirmed the leak on Oct. 23 and disclosed it on Oct. 24 at 1:59 PM ET in an official post on X.

Details

According to Keystone, the exposed data covers names, contact details, shipping addresses and order details (items and prices). The company says payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed. It confirmed the breach after checking API activity with Shopify. Keystone has not said how many customers are affected.

The company says it has blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers. A detailed report is promised. The incident was also covered by Bitcoin.com News and Crypto Briefing.

The main risk for customers is fraud. Keystone warns that scammers may pose as the company by phone, text, email or mail and offer refunds, replacement devices or "fixes" for an order or address. It stresses that it never asks for recovery phrases or private keys and advises against clicking links in unexpected messages.

What it means for the market

Owners' funds were not touched: keys live on the devices, not on the website. But a list of names, addresses and proof of a wallet purchase makes owners an attractive target for phishing and even physical threats. Other wallet makers have had similar customer-data leaks, such as SafePal in August.

Affected customers should ignore any message asking for a recovery phrase and use only Keystone's official channels. For the wider market picture, see the daily brief and the Bitcoin page.