Keystone, a maker of hardware crypto wallets, has admitted that a website vulnerability let an outside party access order shipping data. Buyers' names, contact details and addresses were at risk. The company did not say how many customers were affected.
What the company disclosed
Keystone announced the incident on Saturday, October 24. According to the company, its team spotted suspicious activity earlier in the week. On Friday the suspicion was confirmed after a review of API activity together with Shopify: an unauthorized third party had indeed seen customer shipping information.
The company said it had blocked access, fixed the vulnerability, opened an investigation and is emailing those affected.
"We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers."
Keystone, company statement of October 24, 2026
Keystone also apologized to everyone hit by the leak.
As Cointelegraph reports, the outside party got hold of the following order information:
- buyers' names
- contact details
- shipping addresses
- order contents, meaning which items the person bought
Seed phrases and private keys are not on the list. But a scammer only needs to know that a person bought a hardware wallet and where they live.
The dispute over data retention
In a 2023 blog post, Keystone wrote that it had cut its customer data retention period to 180 days. The reason was a string of incidents at other wallet makers. Now some buyers say they received a breach notice even though they bought their device more than two years ago.
The Block collected similar complaints: customers claim the leak touched data the maker had promised to delete. Cointelegraph asked Keystone how information from purchases older than 180 days could leak and how many people are affected. No answer had come by publication time.
An X user going by OG DEGEN said a scammer called, posing as a law enforcement officer investigating a fraud case. In their view, the plan was to convince them that their private keys had been exposed and then send a phishing link to "reset" them. The user ties the details of a 2024 order, which the caller referred to, to Keystone. A second user, trintaetres, also got a breach email over a purchase made two years ago.
Why addresses are riskier than email
Security researcher Taylor Monahan points to a risk that goes beyond phishing. Leaked shipping addresses could expose buyers to physical attacks and kidnappings. An address combined with proof of a wallet purchase tells an attacker where a person with crypto assets lives.
CertiK data shows the threat is real. In the first half of 2026 the firm recorded 52 verified "wrench attacks", cases where a crypto holder is forced by violence to hand over funds. The same period last year had 39, so the increase is 33%.
It is not the first such case for the industry. In 2020, buyers' addresses also leaked from Ledger, and the consequences lasted for years.
What remains unanswered
Keystone has closed the hole and is sending emails, but the source of the old data and the scale of the leak are still unanswered. Owners who keep Bitcoin on this maker's devices should treat any call or email demanding a key "reset" with suspicion.
Comments
Your email address will not be published. Required fields are marked *