Name, shipping address, contact details, product purchased, and price paid: according to a notice published by the company on October 24, that is the set of data a third party obtained from the online store of Keystone, the hardware wallet manufacturer. The Keystone data breach was detected on October 20 and confirmed on October 23. Keystone states that payment data, wallet passwords, private keys, and seed phrases were not exposed. Still, a shipping address tied to a hardware wallet purchase is a strong signal that the buyer holds crypto at home, and Keystone has not disclosed how many customers are affected.
Keystone’s post on X and the post by researcher Taylor Monahan were not accessible with our tools: we cite them through The Block and crypto.news, which report their content. The same applies to the privacy pages on Keystone’s website, also cited via The Block.
We owe you an apology.
— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…
What Was Exposed, What Was Not
According to The Block and crypto.news, the exposed data includes names, contact details, shipping addresses, and order details covering products and prices. Keystone says payment card data, bank details, seed phrases, private keys, and wallet passwords were not compromised. The company says it blocked the unauthorized access, patched the vulnerability, launched an investigation, and began notifying affected customers, with a detailed report promised “in the coming days.”
The numbers needed to gauge the true scale are missing. Keystone has not said how many customers are involved, in which countries, how long the access was active, how it occurred, or whether the attacker has been identified. According to crypto.news, the Shopify platform running the store does not appear to have been compromised. “You trusted us with those details, and we’re sorry we failed to protect them,” the company wrote in its public notice.
Four Days, Then the Warning
The timeline reconstructed by The Block begins on October 20, when Keystone detected unauthorized access to its official website. On October 23, after reviewing store API activity with Shopify, the company confirmed that a third party had obtained customer data. The public notice followed on October 24 at 19:59 Italian time. On October 25, The Block published reports from customers disputing one specific point: their data, they argue, should have already been deleted.
The 180-Day Deletion Promise
Keystone has marketed the automatic deletion of shipping data as a customer guarantee, though the wording has shifted across different documents. Its Privacy Promise page, cited by The Block, states that all shipping information is deleted automatically 180 days after an order. Posts on X from January, March, and August repeat the commitment: “We delete your shipping data within 180 days at most.” The privacy policy, last updated in May 2021, uses a different trigger: it deletes order data for customers who have not made a purchase in the past 180 days. The help center adds that city and country are not deleted and that final deletion is handled by Shopify.
Customer reports collected by The Block cut against that promise. One customer says they received a breach notification for a purchase made more than two years ago. Another reports that 214 days had elapsed between their last order and the breach. The Block was unable to verify these accounts independently. Keystone has not publicly addressed whether the deletion policy was followed.
Why a Home Address Is Worth More Than a Password
A password can be changed. A home address cannot. According to crypto.news, researcher Taylor Monahan warned that shipping data can expose hardware wallet buyers to physical threats, including robberies and kidnappings, the so-called wrench attacks, where victims are forced to hand over access to their crypto. No physical attacks linked to this specific breach have been reported. The broader context is not reassuring. According to a Chainalysis report cited by Cointelegraph, as many as 46 documented violent incidents occurred through the end of June 2026, with more than $30 million stolen in that six-month period. Chainalysis notes that victims are often targeted through data leaks.
The more immediate risk is targeted phishing. Keystone warns that scammers may impersonate the company by phone, text, email, or physical mail, offering refunds, replacements, or “corrections.” The company advises customers never to enter their seed phrase into a device they did not personally order. One customer told The Block, without independent verification, that they received a call from someone spoofing a Montreal police number, with details matching a 2024 Keystone order. The tactic echoes the Revolut breach involving a fake government request: real data weaponized to make a fraudulent approach seem credible.
Not the First Case of 2026
Keystone joins at least three other hardware wallet manufacturers that have disclosed customer data leaks this year, based on cases reconstructed by The Block. In January, Ledger reported unauthorized access to order data at Global-e, its e-commerce partner, without specifying how many customers were affected. In August, Trezor disclosed the exposure of 13,689 customers through its logistics provider ShipMonk; by September the figure had grown to include approximately 67,000 U.S. customers, for a total exceeding 80,000, according to BleepingComputer. ShipMonk had provided written assurances that the data had been deleted. Also in August, SafePal disclosed that a flaw in its order-tracking system had exposed 39,798 customers.
The common thread is not the device itself, which in none of these cases was compromised, but the commercial chain surrounding it: the online store, payment platform, warehouse, and shipping provider. On the hardware side, 2026 also saw the case of tampered Ledger devices sold by a third-party reseller, though that incident involved altered hardware rather than personal data.
What EU Customers Should Know
Keystone has not said in which countries affected customers are located, so it is not yet known whether European buyers are among them. In the Trezor breach of August 2026, as reported by BleepingComputer, Italy was among the six countries in the first group of customers exposed. For residents of the European Union, the governing framework is GDPR, which applies to non-EU companies that sell to individuals inside the Union. The regulation generally requires notification of a breach to the supervisory authority within 72 hours. Communication to affected individuals when the risk to them is high. It is not known whether Keystone has notified any European data protection authority. EU residents who believe they may be affected can contact their national supervisory authority directly.
Sergiu Gatlan
What Keystone Customers Should Do Now
Keystone has issued two clear directives: treat any contact claiming to represent the company about refunds, replacements, or firmware updates with suspicion, and never share your recovery phrase or private keys under any circumstances. The pattern mirrors the phishing schemes that impersonate exchanges and regulators. Our practical recommendation is to avoid opening email attachments or installing any so-called fix that arrives unsolicited, since a fake update can deliver clipboard-hijacking malware that swaps copied wallet addresses.
For anyone worried about physical risk, the most effective measure is keeping your identity separate from any indication of how much crypto you hold. Avoid discussing your holdings publicly, and consider using a delivery address other than your home for future hardware purchases. Hardware wallets should only be bought directly from the manufacturer's official site or verified authorized resellers, then set up following established best practices for opening and securing a crypto wallet.
Keystone: What We Know and What We Don't
Confirmed facts vs. open questions
- Confirmed: unauthorized access detected on October 20, data theft confirmed on October 23; names, contact details, shipping addresses, purchased products, and prices were exposed; Keystone states no payment data, private keys, recovery phrases, or wallet passwords were compromised; access has been blocked and the vulnerability patched.
- Not disclosed: total number of affected customers and their countries of residence, when the intrusion actually began, the attack method used, the identity of the threat actor, whether the 180-day deletion policy was being followed, and whether regulators were formally notified.
- To watch: the detailed incident report Keystone has promised, the company's response to reports of data that was not deleted as pledged, and any new phishing attempts or physical-contact incidents tied to this breach.
The Bigger Picture for Self-Custody Security
Our read is that 2025 is shifting the weakest point of self-custody away from the device itself and toward the supply chain and logistics layer. Ledger, Trezor, SafePal, and now Keystone have each stated that the wallets themselves were not compromised. In every case, the exposed data was exactly what a shipping label requires. The Keystone incident adds one more dimension: the gap between a data-deletion promise used as a marketing argument and the actual retention rules written into the privacy policy.
Three signals are worth tracking. First, Keystone's promised incident report, including the precise number of affected customers and confirmed access dates. Second, the company's formal answer on the 180-day deletion rule, which will clarify whether older order data should ever have existed on those servers. Third, any verified reports of fraudulent contact or physical incidents linked to the leaked shipping addresses. For anyone buying a hardware wallet, the practical lesson is straightforward: key security starts before you open the box, at the moment you type in a delivery address.
