TheBlock
Hardware wallet maker Keystone has confirmed that a third party obtained customer shipping information from its Shopify-powered online store. The company detected unauthorized access to its official website on Oct. 20 and, three days later, verified through API activity with Shopify that an unidentified attacker had pulled names, contact details, shipping addresses, and order information including items purchased and their prices. Keystone says payment cards, bank details, recovery phrases, private keys, and wallet passwords were not exposed.
Why it matters
The breach cuts directly against Keystone's core marketing. The company repeatedly pitched a 180-day data deletion policy as a selling point, posting on X in January, the same day Ledger customers learned of a leak at that firm's e-commerce partner, that shipping data is "permanently deleted" 180 days after an order. But customers now say older data was still exposed: one user reported a breach notification for an order placed over two years ago, and another says a social engineer holding details of a 2024 order called them spoofing a Montreal police number, days before Keystone's disclosure. The firm's own help center notes that city and country records are never deleted and that deletion is handled by Shopify.
The incident also lands in a brutal stretch for hardware wallet vendors. Trezor disclosed a ShipMonk breach hitting roughly 81,000 customers, SafePal exposed nearly 40,000 via an order-tracking flaw, and Ledger confirmed reseller-sold devices implanted to capture recovery phrases, with onchain losses estimated above $86 million.
Market impact
The immediate risk is phishing, not key theft. Keystone warns that scammers may pose as the company by phone, text, email, or mail offering refunds or replacement devices, and urges customers never to enter a recovery phrase into a device they did not order. The company has not said how many customers are affected or how the attacker got in, and a detailed report is expected in the coming days.
Frequently asked questions
-
What customer data was exposed in the Keystone breach?
An unidentified third party obtained names, contact details, shipping addresses, and order details including items purchased and their prices from Keystone's Shopify-powered online store. Keystone says payment cards, bank details, recovery phrases, private keys, and wallet passwords were not exposed.
-
Did Keystone violate its 180-day data deletion policy?
Several customers say data from orders older than 180 days was exposed, including one with an order placed over two years ago. Keystone's help center notes city and country records are never deleted and that deletion is handled by Shopify. The company has not publicly answered whether it followed its stated policy.
-
How did the attacker access Keystone's store?
Keystone detected unauthorized access to its website on Oct. 20 and confirmed the data theft on Oct. 23 after verifying API activity with Shopify. The company has not said how the attacker got in or whether the attacker has been identified.
-
Is Keystone the only hardware wallet maker hit by a data breach this year?
No. Trezor disclosed a breach at shipping partner ShipMonk affecting roughly 81,000 customers, SafePal exposed nearly 40,000 customers via an order-tracking flaw, and Ledger confirmed reseller devices implanted to capture recovery phrases, with losses estimated above $86 million.
-
How can Keystone customers protect themselves from scams after the breach?
Keystone warns that scammers may pose as the company by phone, text, email, or mail offering refunds, replacement devices, or fixes. Customers should never enter a recovery phrase into a device they did not order and should not follow links sent in messages claiming to be from Keystone.
CryptoSlate
CoinTelegraph
WatcherGuru
WuBlockchain
Crypto Capital Venture
CoinDesk