Keystone confirms breach exposing hardware wallet customers

• Keystone confirmed unauthorised access to its website exposed customer names, contact details, shipping addresses and order information.
• The company detected the breach on 20 October and confirmed the data theft on 23 October.
• Keystone says payment details, recovery phrases, private keys and wallet passwords were not exposed.

Keystone, a cryptocurrency hardware wallet maker, confirmed that an attacker accessed its online store and obtained customer shipping information.

The company detected unauthorised website access on 20 October and confirmed the data theft three days later after reviewing Shopify API activity.

“You trusted us with those details, and we're sorry we didn't keep them safe,” Keystone Wallet said.

The exposed information included customer names, contact details, delivery addresses and order records showing purchased products and prices.

Keystone said payment card details, bank information, recovery phrases, private keys and wallet passwords remained unaffected by the incident.

The company warned that scammers could impersonate Keystone representatives and offer fake refunds, replacement devices or assistance with customer orders.

Keystone said it had blocked unauthorised access, fixed the vulnerability, launched an investigation and begun contacting affected customers by email.

The incident highlights how breaches of online stores can expose cryptocurrency holders to targeted scams even when wallet credentials remain secure, according to Keystone’s disclosure.