Hardware wallet maker Keystone has disclosed a breach that exposed customer information after unauthorized access to its website. The company said the incident involved names, contact details, shipping addresses and purchase records, but did not affect recovery phrases or private keys.
Keystone said it detected suspicious activity on Oct. 20 and later traced it through API activity connected to Shopify, its e-commerce provider. By Oct. 23, the company said it had confirmed that an unauthorized third party obtained buyer data and had already taken steps to stop the intrusion and notify affected customers.
What Keystone says happened
According to the company, suspicious access was first identified on Oct. 20. Keystone then reviewed API activity involving Shopify and determined that customer information had been accessed by an unauthorized party.
The company said it has since blocked the attack path and patched the vulnerability. Keystone also said it started contacting affected users, although it has not stated how many customers were impacted or described in detail how the access was carried out.
What data was exposed
Keystone said the exposed information includes customer names, contact information, shipping addresses and purchase details. Based on the company’s account, the breach did not include wallet recovery phrases or private keys.
That distinction is important because the immediate risk described by Keystone is not direct theft from a device through stolen seed data. Instead, the exposed order and identity information could allow scammers to craft more believable phishing attempts or impersonation messages aimed at wallet owners.
Warnings about scams and impersonation
In its notice, Keystone warned customers to be cautious of messages that appear to come from the company. It specifically flagged fake refund offers, fraudulent replacement-device claims and unsolicited requests for sensitive information.
Keystone said it will never ask users to share a recovery phrase or private key. The company’s warning suggests attackers may try to use real purchase and delivery details to make outreach look legitimate and pressure customers into handing over sensitive wallet information.
Part of a broader pattern in 2026
The disclosure adds Keystone to a list of hardware wallet companies that have faced security-related incidents this year. The source article places Keystone alongside Ledger, Trezor, Safepal and Coldcard as manufacturers that have dealt with breaches, tampering reports or product-related security problems in 2026.
Those incidents have not all involved the same type of failure. In some cases, the reported issue centered on customer data held in ordering or fulfillment systems, creating phishing risks rather than direct compromise of wallet secrets. In another case, Coldcard was reported to have faced a bug tied to weak seed-generation randomness and substantial estimated losses.
What is confirmed next
For now, the confirmed next steps are limited to Keystone’s response measures: the company says it has contained the intrusion, fixed the identified vulnerability and begun notifying affected customers.
What remains unclear is the scale of the breach and the exact method used by the unauthorized third party. Until Keystone provides more detail, the main confirmed risk is targeted social engineering using exposed personal and order information rather than exposure of private keys or recovery phrases.
Source: news.bitcoin.com