Keystone Discloses Website Breach Exposing Customer Shipping Data, Warns of Impersonation Scams

Published October 25, 2026, 8:25 AM PKT. Based on Keystone Hardware Wallet's statement on X of October 24, 2026 (primary source), and reporting by Crypto Briefing, Bitcoin.com, PANews, TokenPost and CoinScreamer (secondary sources), all October 24, 2026.

Hardware wallet maker Keystone disclosed on October 24, 2026 that a third party obtained customer shipping information through unauthorized access to its official website, the latest in a run of security incidents at hardware wallet companies this year. Keystone detected the unauthorized access on October 20, confirmed on October 23 after reviewing API activity with Shopify that a third party had obtained customer shipping information, and disclosed the breach on October 24 at 1:59 PM ET, according to its statement reported by Crypto Briefing, Bitcoin.com, PANews and TokenPost. The company apologized in the statement, writing that customers trusted it with those details, according to Crypto Briefing.

Detected October 20, confirmed October 23, disclosed October 24

The timeline in Keystone's statement is precise about the sequence, and vague about the mechanism. Keystone detected unauthorized access to its official website on October 20, then verified API activity with Shopify, its e-commerce provider, and confirmed on October 23 that a third party had obtained customer shipping information, according to Crypto Briefing and Bitcoin.com. Keystone said it has blocked the unauthorized access, fixed the vulnerability, opened an investigation and is emailing affected customers, according to the same reports. A detailed report is promised in the coming days, according to Crypto Briefing and TokenPost.

What Keystone has not said is just as important for customers trying to judge their exposure. The company has not disclosed how many customers were affected, the dates of the orders involved, or the technical cause of the intrusion, according to Bitcoin.com and CoinScreamer's summary of the statement. Its reference to checking API activity with Shopify does not identify a breach of Shopify's wider platform, and the assurances about excluded data and remediation are Keystone's account of the incident, according to CoinScreamer.

What was exposed, and what was not

The exposed records cover names, contact details, shipping addresses and order details, including the items purchased and their prices, according to Keystone's statement reported by all four secondary sources. That combination matters because it ties a real person, a home address, and proof that the person owns a hardware wallet, which is exactly the profile a targeted scammer wants.

Keystone said the exposed information did not include payment card or bank details, recovery phrases, private keys or wallet passwords, according to Crypto Briefing, Bitcoin.com, PANews and TokenPost. In other words, the breach reached the storefront, not the wallets themselves. Keystone is best known for fully air-gapped, QR-code-based transaction signing, which keeps private keys offline without relying on USB, Bluetooth or Wi-Fi, according to Crypto Briefing. The Hong Kong-based brand has expanded from its Bitcoin-focused origins into a multichain wallet supporting Ethereum, EVM assets, Solana, Polkadot, Cosmos and other networks through integrations with software wallets including MetaMask, Solflare, Keplr, Rabby and OKX Wallet, according to the same report.

The impersonation risk: refunds, replacements, and spoofed calls

Keystone's main warning is not about wallets being drained remotely, it is about criminals using legitimate customer information to manufacture a convincing deception, according to Bitcoin.com. Keystone warned that scammers may pose as the company by phone, text, email or mail and offer refunds, replacement devices or fixes for an order or address, according to Crypto Briefing and PANews. The company stressed that it never asks for recovery phrases or private keys, and urged customers to avoid clicking links in unexpected messages, according to Crypto Briefing.

Bitcoin.com noted that one customer had already reported, the day before Keystone confirmed the breach, receiving a call from a spoofed Montreal police number in which the caller tried social engineering. That report is a single customer account, not a confirmed link to the breach, but it shows the shape of the risk Keystone is warning about: a caller who already knows who you are, where you live, and what you bought sounds far more plausible than a stranger. Customers should independently verify any communication through Keystone's official website rather than following unexpected links, according to Bitcoin.com, and should never disclose recovery phrases or enter them into a device they did not order, according to Crypto Briefing.

A difficult year for hardware wallet makers

Keystone's disclosure follows a difficult year for hardware wallet manufacturers, according to Bitcoin.com. In August, Trezor disclosed a customer data breach at its logistics provider ShipMonk, while Ledger confirmed earlier in October that criminals had modified genuine hardware wallets to steal recovery phrases and resold them through Southeast Asian resellers, according to Crypto Briefing. Coldcard faced a bug with weak seed-generation randomness and substantial estimated losses, while Trezor and SafePal also disclosed customer information breaches involving third-party fulfillment or ordering systems, according to Bitcoin.com. Unlike incidents involving compromised recovery phrases, those exposures primarily created opportunities for phishing and impersonation, according to the same report.

The pattern is the point. The cryptographic defenses of the devices reportedly held in these cases, but the customer records around them did not receive comparable protection, according to Bitcoin.com. For Keystone, as for the others, the troubling question is whether customers' personal information received the same protection as their private keys.

What customers should do now

The practical steps follow directly from Keystone's warning. Treat any unexpected call, text, email or letter claiming to be Keystone, especially one offering a refund, a replacement device, or a correction to an order or delivery address, as suspect until verified through Keystone's official website. Never share a recovery phrase or private key with anyone, and never enter a recovery phrase into a device that arrives unrequested. Customers who receive an unexpected device should not use it. Affected customers should watch for the email notification Keystone says it is sending, and for the detailed report the company has promised in the coming days, which should answer the two open questions: how many customers were affected, and how the intrusion happened.

This article is news reporting and is not investment advice.

Sources

• Keystone Hardware Wallet, statement on X (October 24, 2026), primary source
• Crypto Briefing, Keystone Hardware Wallet says website breach exposed customer data (October 24, 2026), secondary source
• Bitcoin.com, Keystone Wallet Data Breach Exposes Buyers' Addresses to Scammers (October 24, 2026), secondary source
• PANews, Keystone hardware wallet website hit by unauthorized access, user names and shipping addresses leaked (October 24, 2026), secondary source
• TokenPost, Keystone Website Breach Exposes Customer Shipping and Order Details (October 24, 2026), secondary source
• CoinScreamer, Keystone Store Breach Exposes Customer and Shipping Data (October 24, 2026), secondary source