OneKey’s founder Yishi Wang has committed to deleting customer data within 30 days following an admission of failure from rival hardware wallet maker Keystone regarding its 180-day deletion system after a breach that exposed nearly 26,000 buyer records.
Keystone’s help center noted that the final deletion of user records is handled by Shopify. That disclosure exposes a security flaw at the level of Shopify stores and logistics firms, beyond wallet makers like OneKey and Keystone’s control, despite the former’s 30-day pledge
Why OneKey is cutting its data retention window
OneKey’s Yishi Wang confirmed on Tuesday that the hardware wallet maker is auditing its own security system after recent breaches and supply chain attacks exposed security flaws in the sector it operates in.
Wang stressed that the move is precautionary, writing that “OneKey has NOT experienced a security” incident. Rather, the decision to cap data retention at 30 days is a direct answer to what went wrong elsewhere.
The reasoning behind the shorter data retention window is that the longer a vendor keeps customer data, the larger the pool of customer data that can be exposed in breaches.
What caused the Keystone breach?
Keystone revealed that the system that automatically deletes customer data at the end of its 180-day data retention period had stopped working without setting off any red flags. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company said.
Keystone found 25,964 records still carried personal data, names, shipping addresses, contact details and purchase histories during a review of 51,083 Shopify buyer records. Apparently, data going back to 2024 were still retained, way past the 180-day limit the firm highlighted after Ledger customers learned of a leak at e-commerce partner Global-e in January 2026.
Investigators found sensitive details in another 12,873 unpaid checkout records.
In response, Keystone has now shortened its retention window to 90 days.
Keystone also revealed on October 26 that attackers also lifted the WebAuth key its devices use to prove they are genuine, tracing the break-in to a flaw in a third-party monitoring tool that let intruders raise their access. Keystone first spotted the activity on October 20.
Because the key is burned into each device during manufacturing and cannot be overwritten, Keystone plans to destroy all 18,835 units in inventory that carry it. New wallets get a replacement key.
The firm has halted shipments of outstanding website orders and moved to preorders.
Deletion promises are only as good as the partners holding the data
Notably, hardware wallet makers are not the only ones who keep customer data. E-commerce platforms and shipping partners also handle customer names, addresses and order histories, and that level is where most of the recent breaches have occurred.
Trezor’s data leak reached 81,000 customers after its shipping partner ShipMonk failed to delete records despite repeated written assurances. SafePal exposed about 39,798 customers through an order-tracking flaw and has since pulled its retention down to 90 days. Ledger confirmed that resold devices from CryptoBilis hid chips that captured recovery phrases. Cryptopolitan, citing on-chain researchers, estimated losses at more than $86 million.
If you're reading this, you’re already ahead. Stay there with our newsletter.