Keystone Hardware Wallet has confirmed that its official website was accessed without authorization, exposing customer names, contact details, shipping addresses, and order information. The company disclosed the breach on Saturday following a multi-day review of the incident, stating that payment details and all wallet-related security credentials were not compromised.

The unauthorized access took place on October 20. According to Keystone, the company detected suspicious activity and then reviewed API activity with Shopify, its e-commerce provider. By October 23, Keystone had confirmed that a third party had obtained customer data. The company subsequently blocked the unauthorized access and patched the underlying vulnerability.

News of the confirmation was shared on X by blockchain media outlet Wu Blockchain:

Keystone Confirms Customer Data Exposure Following Unauthorized Website Access

Keystone Hardware Wallet confirmed that a third party obtained customer shipping and order information following unauthorized access to its official website. The incident was detected on October 20,… pic.twitter.com/tZMXH6xIHZ

— Wu Blockchain (@WuBlockchain) October 24, 2026

What Data Was Exposed

According to the company's disclosure, the exposed information includes customer names, contact details, and shipping addresses, along with order details such as the items purchased and their prices. Keystone said payment card and bank details were not compromised, and wallet passwords, private keys, and recovery phrases were also unaffected. Those credentials are what ultimately control access to funds in self-custody, which is why the disclosure drew a sharp line between order records and wallet security.

The company has not disclosed how many customers were affected, nor has it specified exactly how the unauthorized access occurred. Keystone has opened an investigation, which it described as thorough, and is notifying affected customers by email.

Scam Warnings for Customers

Keystone cautioned that scammers could exploit the incident by posing as company representatives, potentially offering refunds, replacement devices, or help with orders and shipping addresses. The company urged customers to avoid unexpected links and reiterated that it never asks for recovery phrases or private keys. Customers were also advised not to enter recovery phrases into devices they did not order. Because the exposed records show exactly who ordered a device and where it was shipped, the warnings treat the incident primarily as a targeting risk for customers rather than a direct threat to stored funds.

A day before the official confirmation, an X user known as OG Degen reported receiving a call from a spoofed Montreal SPVM number, saying that the caller had attempted to social engineer them. Binance founder CZ also commented on the breach on X.

About Keystone

Keystone is a Hong Kong-based wallet brand known for its air-gapped, QR-code-based approach to transaction signing, a design that keeps private keys offline without USB, Bluetooth, or Wi-Fi connections. The company grew from Bitcoin-focused origins into a multichain wallet and now supports Ethereum, Solana, Polkadot, and Cosmos through integrations with software wallets such as MetaMask, Solflare, Keplr, Rabby, and OKX Wallet.

Industry-Wide Security Incidents in 2026

Keystone's disclosure adds to a series of security problems affecting hardware wallet makers in 2026. Trezor disclosed in August a customer data breach at its logistics provider, ShipMonk. Ledger confirmed earlier this month that criminals had modified genuine wallets to steal recovery phrases and resold them through Southeast Asian resellers. Coldcard faced a bug involving weak seed generation, and Safepal disclosed a customer information breach. Taken together, the incidents show how customer records connected to ordering and fulfillment — from e-commerce storefronts to logistics partners — have become a recurring point of exposure for hardware wallet makers this year.

What Comes Next

Keystone said it plans to release a detailed report on its investigation in the coming days. The company posted its initial disclosure on X on Saturday at 1:59 p.m. ET. Until then, affected customers can expect notifications by email, and the company's guidance remains to treat unsolicited contact — especially any request for a recovery phrase — as a red flag.

Source: CoinCentral