Keystone Hardware Wallet has confirmed that unauthorized access to its official website exposed customer names, email addresses, phone numbers, shipping addresses and purchase records. The intrusion was detected on October 20, 2026, and confirmed three days later, on October 23, following a review of Shopify application programming interface activity, according to an October 24 disclosure by the hardware wallet manufacturer.

In the disclosure, the company said an unauthorized third party had obtained order information. Keystone blocked the access, fixed the identified vulnerability and opened an investigation. The company has not identified the attacker, and the number of affected customers remains undisclosed. No tally of compromised transactions accompanied the announcement.

Wu Blockchain, a crypto industry news account, shared the disclosure on X:

Keystone Confirms Customer Data Exposure Following Unauthorized Website Access Keystone Hardware Wallet confirmed that a third party obtained customer shipping and order information following unauthorized access to its official website. The incident was detected on October 20,… pic.twitter.com/tZMXH6xIHZ

— Wu Blockchain (@WuBlockchain) October 24, 2026

Order Records Exposed, Wallet Credentials Unaffected

The incident exposed records linked to purchases of cryptocurrency storage devices rather than information held inside the wallets themselves. The compromised records listed the products customers bought and the prices they paid, alongside their identities and delivery locations. The affected information therefore connected device purchases to identifiable customers, but no compromise of wallet credentials was reported.

Because hardware wallets are physical goods that must be shipped, their makers hold the same category of retail records as any e-commerce merchant — a structural feature of the market that places customer identity data in storefront systems regardless of how securely the devices themselves operate.

Keystone said payment card numbers, bank account details, wallet passwords, private keys and recovery phrases were not exposed. Its wallets perform transaction signing offline, communicating by QR code rather than through direct connections to internet-enabled devices.

Shopify Infrastructure Leaves Open Questions

Shopify operates the manufacturer's online store and processes its order information, according to the company's privacy policy. That policy also states that records are deleted after 180 days when a customer has not placed another order. The deletion provision does not identify which historical purchases were included in this breach, and the disclosure did not specify the affected purchase dates.

The disclosure also did not establish how long unauthorized access remained possible. Investigators have not publicly attributed the intrusion or explained the precise method used to enter the website. Affected customers were being notified by email, and the company said a fuller incident report would follow, although it supplied no publication date.

Phishing Warnings to Customers

Despite the assurances around wallet security, Keystone warned customers to watch for fraudulent refund offers, replacement device schemes and messages claiming to provide order assistance. Such approaches may appear through email, phone calls or text messages. Each involves claims about a customer's order or device — the categories of information contained in the exposed records. Customers were advised not to share recovery phrases or private keys, not to enter recovery phrases into unexpected replacement devices and not to follow suspicious links. The company urged customers to verify all communication through its official channels.

Part of a Broader Pattern for Hardware Wallet Sellers

The breach joins a series of customer data incidents involving hardware wallet sellers. In August, Trezor disclosed a breach at its shipping provider ShipMonk, later identifying approximately 67,000 additional affected U.S. customers. SafePal also disclosed an order-tracking authorization flaw affecting 39,798 customers, in which personal and purchase records were exposed without direct compromise of wallet credentials.

Taken together, the incidents span different layers of the retail chain — a storefront platform for Keystone, a shipping provider for Trezor and an order-tracking function for SafePal. Across these incidents, the exposed information sat in ordering or fulfillment systems rather than in wallet signing mechanisms. Keystone has yet to publicly disclose its affected customer count, the underlying access method or the exposure window. The promised fuller incident report, for which no date was given, is the announced avenue for those answers.