Keystone Says 20 October Breach Exposed Customers’ Shipping Data

If you have bought a Keystone hardware wallet, treat any unexpected call, text, email or letter offering a refund, a replacement device or a “fix” for your order as a scam. Keystone has warned that criminals may now pose as the company, after it said a third party obtained customers’ names, contact details, shipping addresses and order details from its official website.

“NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn’t order. We will never ask for them,” the company wrote in an announcement on X at 18:59 BST on 24 October. It added: “Don’t click links in unexpected messages. Type keyst.one yourself.”

Keystone says payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed. No loss of funds has been reported. TSN tracks incidents like this on its crypto hacks and exploits hub.

What Keystone says happened

According to the announcement, Keystone “detected unauthorized access to our official website” on 20 October. “After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information,” it said. Keystone has not said how the attacker got in, and it has not suggested that Shopify itself was breached.

The company listed what was taken: “names, contact details, shipping addresses, and order details (items and prices).” It said it has “blocked access, fixed the vulnerability, opened an investigation” and is emailing affected customers. It has not said how many people are affected.

The announcement opened with an apology. “We owe you an apology,” Keystone wrote. “You trusted us with those details, and we’re sorry we didn’t keep them safe.”

Keystone was looking into reports before it went public. At 06:08 BST on 24 October, it replied on X to a user who had reported a suspicious phone call, saying: “We have initiated an urgent investigation into this matter and will share our official findings as soon as possible.” In the same reply it urged people to “stay vigilant against any suspicious phone calls, SMS, or emails.”

How to protect yourself now

Keystone’s advice is specific. It says scammers “may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or ‘fixes’ for your order or address. None of it is from us.”

In practice, that means:

• Never type your recovery phrase into a website, app or form, and never read it out over the phone.
• Never set up a device that arrives without your having ordered it, and never enter your existing recovery phrase on one.
• Ignore links in unexpected messages. Type keyst.one into your browser yourself.
• If something feels wrong, Keystone asks customers to email support@keyst.one. “We’d rather hear from you than have you take a chance,” it said.

Keystone says “A detailed report is coming soon.” In a reply on X, it said that report “will be published in the upcoming week”.

A home address turns phishing into a doorstep risk

The data taken does not unlock a single wallet, and Keystone’s own list makes that clear. But the combination is valuable to fraudsters. A name, phone number and home address, matched to an order for a crypto hardware wallet, tells a criminal who is likely to hold self-custodied coins and where they live. That makes a fake “replacement device” in the post, or a call that quotes a real order, far more convincing.

This is the same pattern seen when NGRAVE’s app was used to send a fake security alert: the hardware held, and attackers went after the owner instead. In both cases, the only thing that protects the funds is the recovery phrase staying private. The hardware implant case involving Ledger devices is a reminder of why Keystone’s warning about unordered devices matters.

Keystone’s 180-day deletion promise is now the key question

Keystone’s Privacy Promises page says: “All shipping information is automatically deleted 180 days after your order is placed.” It adds that customers can ask for their details to be deleted once their device has been delivered.

If that policy worked as described, the exposed records should be limited to recent orders. Keystone has not yet said whether that was the case, how many customers were affected or how the attacker reached the data through its website. Those are the answers its promised report needs to give, and they will tell older customers whether the warning applies to them.

Keystone is not the only self-custody firm under pressure this month. Trezor has cut its reseller network, and a browser wallet extension leaked users’ keys this month. Until Keystone’s report arrives, the safest assumption for any recent buyer is that a scammer may know their name and address, but not their recovery phrase. It is up to the owner to keep it that way.

Sources

• Keystone (@KeystoneWallet): announcement on X, 24 October 2026
• Keystone (@KeystoneWallet): reply on X on the detailed report, 24 October 2026
• Keystone (@KeystoneWallet): reply on X on the urgent investigation, 24 October 2026
• Keystone: Privacy Promises

Related stories

• NGRAVE Fake App Alert Drained Wallets; Bitquery Estimates $2.65m Taken
• Ledger Confirms an Unauthorized Hardware Implant in One Device Affected in the CryptoBilis Case
• Trezor Cuts the Number of Shops Allowed to Sell Its Hardware Wallets
• Polkadot Foundation Says Fearless Wallet Extension Leaked Users’ Private Keys
• Crypto Hacks and Exploits: TSN Story Hub