Hardware wallet manufacturer Keystone has confirmed a customer data breach that exposed names, contact information, shipping addresses and purchase records after an unauthorized third party gained access to its website.

The company detected suspicious activity on October 20, 2026, and confirmed the data theft on October 23 after examining Shopify API activity. The compromised records included the products customers purchased and their prices — details that could be used to identify hardware wallet owners and their physical addresses. Because hardware wallets keep the private keys that control cryptocurrency holdings offline, records tying a specific device to a home address are treated as sensitive even where the devices themselves were not compromised.

Keystone disclosed the incident publicly on October 24 in a statement on X, confirming that payment card details, bank information, recovery phrases, private keys and wallet passwords were not exposed.

The manufacturer has since blocked the unauthorized access, patched the vulnerability and begun notifying affected customers by email. It has not said how many customers were exposed or how the attacker obtained the information.

Shopify API Activity Exposed Purchase Records

Keystone's investigation traced the unauthorized access to the e-commerce infrastructure supporting its website, rather than a compromise of its hardware wallet devices. The exposed data combines customer identities and delivery addresses with specific purchase histories, creating opportunities for attackers to impersonate the manufacturer using genuine transaction details.

An attacker could reference a customer's actual order, purchased device or shipping address when attempting to extract further information through fraudulent calls, emails or messages. Keystone has warned that scammers may offer refunds, replacement hardware wallets or help resolving supposed delivery problems, with such approaches potentially arriving by email, text message, telephone or physical mail.

The company has not identified the attacker, established how many records were taken, or disclosed whether the intrusion involved compromised API credentials, an application vulnerability or another access method. Shopify's involvement in the API investigation does not indicate that Shopify's wider infrastructure was compromised.

Latest in a String of Wallet-Maker Breaches

The incident follows a series of similar breaches involving cryptocurrency wallet manufacturers and their e-commerce partners.

In September, Trezor expanded its investigation into a ShipMonk data breach after discovering that approximately 67,000 additional American customers had their personal information exposed. The affected records included names, phone numbers, email addresses, shipping details and order histories dating back to 2019, sharply expanding an incident that initially involved 13,689 customers.

In August, SafePal disclosed an order-tracking vulnerability that exposed personal and purchase information belonging to 39,798 customers. The company traced the incident to an authorization flaw in a plug-in used to access shipment information.

In January, Ledger customers faced targeted phishing attempts after a breach at e-commerce partner Global-e, with fraudulent messages circulated using customer data exposed through the third-party provider — a sequence similar to the follow-up scam approaches Keystone is now warning its own customers about.

While the technical causes and affected infrastructure differed, each case involved customer information held by commercial or fulfillment systems.

Warning Against Fake Replacement Devices

Keystone has urged customers to avoid clicking links in unexpected communications and to reach its official website directly when seeking support. The manufacturer specifically warned against entering recovery phrases into unsolicited replacement devices or sharing private keys with anyone claiming to represent its customer service team.

Customers who have already disclosed a recovery phrase to a suspected scammer should treat that wallet as compromised and move any remaining assets to a new wallet generated with a fresh recovery phrase.

Keystone is continuing its investigation and plans to publish a detailed technical report in the coming days. The company has not disclosed any evidence of cryptocurrency theft resulting from the breach, nor has it confirmed a timetable for completing customer notifications. Its forthcoming report is expected to provide further details about the intrusion and the affected customer records.