Keystone Confirms Customer Data Theft in October Website Breach
Key Takeaways
- •Keystone, a maker of air-gapped hardware wallets, confirmed that customer data was stolen in a breach of its website in October 2026.
- •The company had repeatedly publicized a commitment to permanently delete shipping data 180 days after an order, including posts on X in January, March, and August and a statement on its Privacy Promise page.
- •Keystone's wallets keep users' private keys offline and rely on QR codes to sign transactions for Bitcoin and other cryptocurrencies.
- •Hardware wallet vendors commonly collect customers' shipping information for order fulfillment, and data retention periods are a frequent point of emphasis in industry privacy policies.
- •As of the initial report, Keystone had not disclosed the scope of the breach, the categories of data stolen, or the number of customers affected.
Hardware wallet maker Keystone has confirmed that customer data was stolen in a breach of its website in October 2026.
The confirmation brings renewed attention to the company's publicly stated data-handling commitments. Over recent months, Keystone repeatedly promoted a pledge that shipping data is permanently deleted 180 days after an order. The company posted the claim on X on January 5, repeated it in further posts in March and August, and featured it on its Privacy Promise page.
Keystone develops air-gapped hardware wallets designed to keep users' private keys offline, relying on QR codes to sign transactions for Bitcoin and other cryptocurrencies. Because these wallets are physical products shipped to buyers, customers' shipping information is generally collected for order fulfillment, and how long vendors retain such data is a common point of emphasis in industry privacy policies — the backdrop against which Keystone's 180-day deletion pledge was repeatedly promoted.
As of the initial report, Keystone had not disclosed the scope of the breach, the categories of data taken, or the number of customers affected. Those specifics, which would allow customers to weigh the confirmed theft against the company's published data-handling commitments, remain undisclosed.
This content was first published on COINOTAG: https://en.coinotag.com/keystone-website-breach-customer-data-theft
