Crypto hardware wallet maker Keystone has disclosed a website security breach that exposed customer information to attackers, raising concerns about targeted scams and physical attacks.

The company said Saturday that it detected suspicious activity earlier in the week and confirmed on Friday, after reviewing API activity with Shopify, that an unauthorized third party had accessed customer shipping information. The exposed data included names, contact details, shipping addresses and other order details, such as the items purchased.

“We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” the company said in a statement on X.

Keystone warned that the exposed information could be used for targeted phishing attacks. Security researcher Taylor Monahan raised additional concerns, noting that leaked shipping addresses could expose customers to physical attacks and kidnappings. The episode highlights a gap specific to hardware wallet ownership: the devices are built to keep private keys offline, but the customer data held by their makers can be turned against the person holding the wallet.

The disclosure comes amid a rise in so-called “wrench attacks” — crimes in which physical threats or violence are used to force cryptocurrency holders to surrender their assets. Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 during the same period last year.

“Again, we’re truly sorry to everyone affected,” Keystone said. The company did not disclose how many customers were impacted.

Keystone questioned over promise to delete customer data

The breach has also raised questions about Keystone’s handling of older customer information. In a 2023 blog post, the company said it had reduced its customer data retention period to 180 days following security incidents affecting other hardware wallet manufacturers.

However, some customers said they received breach notifications despite purchasing their devices more than two years ago, raising questions about what information Keystone retained and whether the notifications indicate that older order records were not deleted as promised.

One X user going by “OG DEGEN” said they received a call from a scammer claiming to be law enforcement investigating a fraud case. Based on the personal information the caller referenced, the user suspected it was obtained through a Keystone order placed in 2024.

“I think their plan was to convince me that my private keys had been exposed and then send me a phishing link to supposedly reset them,” the user wrote on X. That combination of impersonation, urgency and a link to “fix” exposed keys follows a familiar phishing structure aimed at getting users to enter their recovery phrase — the set of words that can restore a hardware wallet’s contents anywhere — on an attacker-controlled site.

Another X user, trintaetres, also said they received the email notification despite buying the device more than two years ago.

Cointelegraph contacted Keystone to ask how customer information from purchases made more than 180 days earlier could have been exposed despite the previously announced retention policy, and how many customers were affected. The company did not respond by publication time. With its investigation ongoing, what affected customers and observers will be watching next is whether Keystone explains why records beyond the 180-day window appear to have been retained, and how many people were exposed.