The Keystone wallet breach exposed customers’ names, contact details, delivery addresses and purchase records—but not wallet credentials, the hardware-wallet maker said on October 24, 2026. Keystone warned that the stolen information could help scammers impersonate its support team.
Key takeaways
- Keystone confirmed customer-data theft after checking Shopify API activity.
- Payment information and wallet secrets remained unexposed, Keystone said.
- The company closed the vulnerability and began notifying customers.
What the Keystone wallet breach exposed
The stolen records included shipping addresses, customer contact information, products purchased and their prices. Keystone detected unauthorized website access on October 20, 2026, and confirmed the theft on October 23, 2026, after reviewing API activity with Shopify, which powers its online store.
Keystone said payment cards, bank details, recovery phrases, private keys and wallet passwords were not exposed. The reference to Shopify API activity identifies evidence examined during the investigation; it does not establish that Shopify’s underlying platform was compromised.
Keystone’s response and data-retention policy
Keystone said it blocked unauthorized access, repaired the vulnerability, opened an investigation and began emailing affected customers. Its notice did not specify the number of people affected or the duration of access.
The Keystone wallet breach also puts its published retention promises in focus. Its Privacy Promise page says shipping information is automatically removed 180 days after an order. Its privacy policy, last updated in May 2021, instead describes deleting order information for customers who have not ordered within the preceding 180 days.
A help-center article says city and country records remain and that Shopify handles final deletion. Keystone also promoted the 180-day shipping-data deletion policy in posts in January, March and August 2026.
Order records create phishing and physical-security concerns
Names, delivery locations and purchase details can make fraudulent support messages more convincing and identify potential physical targets, even without wallet credentials. Security developer Taylor Monahan, known online as Tay, warned that exposed shipping information could put buyers at risk of robbery or kidnapping.
Keystone warned of impersonators contacting customers through calls, texts, emails or postal mail with offers of refunds, replacement devices or supposed order and address fixes. The company advised customers never to share recovery phrases or private keys with anyone, and never to type a recovery phrase into a device they had not specifically requested.
Customers should avoid links in unexpected messages, visit Keystone’s website directly and contact official support about suspicious communications, Keystone said.
Similar leaks at Trezor and SafePal
Customers of other hardware-wallet makers have encountered similar exposure tied to shipping and order-management systems. According to Trezor’s revised disclosure, its shipping-provider breach affected 80,689 customers; the company cautioned about phishing risks and physical-security threats while noting that parcel contents remained unexposed.
SafePal revealed a vulnerability in an order-tracking plug-in that affected roughly 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. The data exposed included names, email addresses, phone numbers, delivery addresses and purchase information.
Keystone stated that its investigation remained ongoing and committed to releasing a detailed report “in the coming days.”
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.