Keystone Hardware Wallet says October 20 website breach exposed customer names, addresses and order details

Keystone Hardware Wallet told customers Saturday, Oct. 24, that someone broke into its official website and walked off with personal data.

The company posted an apology on X. "We owe you an apology," it wrote. "On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information."

What was taken

Keystone says the exposed data includes customer names, contact details and shipping addresses. It also includes order details, meaning the items purchased and the prices paid.

The company says payment card and bank details were not compromised. Neither were wallet passwords, private keys or recovery phrases. That is Keystone's own account of its own systems, and the company has not yet published the investigation behind it.

The timeline

The sequence, as the company lays it out:

• Oct. 20: Keystone detects unauthorized access to its website.
• Oct. 23: After reviewing API activity with Shopify, its e-commerce provider, Keystone confirms a third party obtained customer shipping information.
• Oct. 24: Keystone discloses the breach publicly and says it is notifying affected customers by email.

Keystone says it has blocked the access, patched the vulnerability and opened an investigation. It says a detailed report will follow "in the coming days."

What Keystone has not said

The company has not disclosed how many customers were affected. It has also not explained how the intruder got in, beyond saying the problem was a vulnerability that has now been patched.

Those are the two facts a customer most needs to judge their own exposure. The report Keystone has promised is where they would be expected to appear.

One X user also asked Keystone to confirm whether only customers from the last 180 days are affected, and noted the company had not confirmed that older customers are unaffected.

The scam risk

Keystone's own warning points at the practical danger. Scammers holding real names, addresses and order histories can sound very convincing.

The company warned that fraudsters may pose as Keystone by phone, text, email or postal letter. They may offer refunds, replacement devices or help correcting orders and addresses.

Keystone's instructions to customers are specific:

• Never give anyone a recovery phrase or private key. Keystone says it never asks for them.
• Never enter a recovery phrase into a device you did not personally order.
• Do not click links in unexpected messages. Type the official website address by hand.
• When in doubt, contact customer support through official channels.

A customer's warning before the disclosure

One X account says it was targeted the day before Keystone confirmed the attack. The account OG Degen wrote that it was "99% convinced your customer database may have been leaked." The user said it had received a call from a spoofed Montreal SPVM number and that "the guy tried to social-engineer me."

That is one user's account. It does not establish that the call came from whoever accessed Keystone's site, and it does not show the exposed data was used. It does illustrate the kind of targeting the company is now warning about.

A product built to keep secrets offline

Keystone is best known for air-gapped, QR-code-based transaction signing. That design keeps private keys offline without USB, Bluetooth or Wi-Fi.

The company has grown beyond its Bitcoin-focused origins into a multichain wallet. It supports Ethereum, EVM assets, Solana, Polkadot, Cosmos and other networks through software wallets including MetaMask, Solflare, Keplr, Rabby and OKX Wallet.

The breach hit the storefront, not the device. An offline signing design does nothing to protect a customer database sitting behind a website.

Not the only wallet maker with problems this year

Other hardware wallet makers have had their own incidents. In August, Trezor disclosed a customer data breach at its logistics provider, ShipMonk. Earlier this month, Ledger confirmed that criminals had modified genuine hardware wallets to steal recovery phrases and resold them through Southeast Asian resellers.

Those cases differ from Keystone's. The Trezor breach was at a vendor, and the Ledger case involved tampered devices. Keystone's involves its own website.

What comes next

Keystone's detailed investigation report is the next concrete step. It is expected to shed light on how the intruder got in and how many customers were affected. Customers will also be watching whether the company's claim that no keys or payment data were touched holds up under scrutiny.

Until then, customers who bought from Keystone have only the company's word and a list of scam tactics to watch for.