Keystone Confirms Customer Data Theft in October Website Breach

Keystone Confirms Website Breach

Keystone, the maker of an air-gapped hardware wallet, has confirmed that an outside party stole customer shipping information from its online store. In a disclosure posted from the company's official account on October 24, Keystone said it detected unauthorized access to its website on October 20 and, after reviewing application programming interface activity with Shopify, its e-commerce provider, confirmed on October 23 that a third party had obtained the data. The statement opens with an apology, acknowledging that customers trusted the company to protect their personal information. The records taken during hardware wallet purchases include names, contact details, shipping addresses, the products ordered and their prices. Payment card information, bank details, recovery phrases, private keys and wallet passwords were not exposed, according to the disclosure. Keystone said it has blocked the unauthorized access, corrected the vulnerability and opened an investigation, and it has begun emailing affected customers while preparing a detailed incident report. The announcement stops short of several specifics: it does not name the attackers, give a customer count, state when the intrusion first began or say which weakness was exploited. The company has not determined publicly whether the intruder used a stolen API credential, a flaw in the storefront application or another infrastructure weakness. Keystone's reference to Shopify API activity identifies what investigators examined to confirm the theft, but it does not establish that Shopify's platform itself was compromised. Shopify supplies store infrastructure and programming interfaces that allow merchants and authorized applications to manage customer records and orders, and the permissions granted to a connected application decide how much data it can reach. Which credentials or permissions featured in this incident remains undisclosed.

@KeystoneWallet · X post

Disclosure.

View on X

Phishing Warnings and Physical Threats

The immediate danger from the leak sits outside Keystone's systems. Names and home addresses identify people who have bought hardware wallets, and real order details make fraudulent messages far more convincing. The company warned customers about scammers impersonating Keystone through email, telephone calls, text messages or physical mail, with fake refunds, replacement devices and requests to correct delivery information among the expected lures. It told users never to share a recovery phrase, never to enter a recovery phrase into a device they did not order, and to contact official support directly when a suspicious communication arrives. Security developer Taylor Monahan went further, and her warning about physical threats covered robbery and kidnapping, a pattern known in the industry as a wrench attack, where criminals use violence to force holders to surrender their assets. No confirmed evidence in the disclosure links the stolen records to an attack that has already happened. Former Binance chief executive Changpeng Zhao reacted to the announcement with a short message: “Stay SAFU!” The incident recalls the 2020 breach at rival maker Ledger, where an attacker used an API key to reach part of the company's e-commerce and marketing database. Ledger initially counted about one million compromised email addresses and detailed personal information for roughly 9,500 customers; when the stolen database surfaced publicly in December 2020, the company acknowledged a larger exposure of about 272,000 records containing names, postal addresses and telephone numbers. Fraudulent letters impersonating Ledger were still reaching customers as recently as April 2025, instructing recipients to scan QR codes and enter their recovery phrases. Separately, Ledger has been investigating asset losses among users who bought devices from a Southeast Asian reseller and has asked that reseller to pause sales and shipments as a precaution.

@tayvano_ · X post

Warning about physical threats.

View on X

Questions Keystone Has Not Answered

The load-bearing fact in the disclosure is what was not taken: the cold wallet design held, no crypto wallet credential appeared in the stolen set, and the exposure is entirely personal data. The risk therefore migrates to the human layer, where an attacker pairs a genuine order history with a phone call or letter. Keystone's pending report should answer three open questions: how many customers were affected, when the access began and which credential the intruder used. The six-year tail of Ledger's 2020 database, still feeding scams as of last year, argues for treating every unsolicited refund, replacement or delivery message as hostile until verified with the manufacturer directly.