Keystone Fault Exposes Hardware Wallet Buyers’ Addresses After Web Breach

Keystone, the crypto hardware wallet company, has disclosed that a website security breach exposed customer shipping and order details to an unauthorized third party. The incident, which Keystone says was identified earlier in the week and confirmed after reviewing API activity with Shopify, could increase the risk of targeted phishing and other scams.

The disclosure comes amid rising concern for real-world “wrench attacks,” a category of crimes where victims are threatened or harmed to force them to surrender cryptocurrency. Security firm CertiK reported that it recorded 52 verified wrench attacks worldwide in the first half of 2026—up from 39 during the same period in 2025.

Key takeaways

• Keystone says attackers accessed customer shipping information, including names, contact details, shipping addresses, and order contents.
• The company reported blocking the access, fixing the vulnerability, and opening an investigation, while emailing affected customers.
• Keystone did not disclose how many customers were impacted, but the exposure increases the plausibility of targeted phishing campaigns.
• Customers questioned whether older order data was deleted consistent with Keystone’s earlier retention-policy claims.
• CertiK data highlights that physical extortion crimes (“wrench attacks”) have increased year over year, making address exposure particularly sensitive.

What Keystone says was exposed

Keystone stated that it detected suspicious activity earlier in the week and confirmed the breach on Friday after reviewing API activity with Shopify. In the company’s description, an unauthorized third party gained access to customer shipping information tied to orders, including personal and delivery data.

According to Keystone, the accessible records included customer names, contact information, shipping addresses, and other order details such as items purchased. Keystone said it blocked the unauthorized access, addressed the vulnerability, began an investigation, and is contacting affected customers via email.

Keystone warned that the exposed information could be used to facilitate targeted phishing attacks—an escalation in threat likelihood compared with generic scams, because attackers can tailor messages using real order details.

Why address leaks matter in the hardware wallet era

Security researcher Taylor Monahan raised concerns that shipping-address disclosure could extend beyond digital fraud. In particular, Monahan suggested that knowledge of where customers live could increase the risk of physical attacks, including crimes intended to coerce wallet holders into surrendering assets.

That concern intersects with broader trends in physical crypto crime. CertiK, in coverage cited by Cointelegraph, reported 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 during the same period the previous year. These incidents typically involve intimidation, threats, or violence intended to force cryptocurrency holders to hand over funds.

While Keystone did not provide details about whether physical targeting is already occurring, the combination of hardware wallet adoption and address exposure is precisely what makes real-world security planning more urgent for affected customers and the wider industry.

Questions over retention policy and older customers

Beyond the breach itself, the incident has prompted scrutiny of how Keystone handles older customer data. In a 2023 blog post, Keystone said it reduced its customer data retention period to 180 days following security incidents affecting other hardware wallet manufacturers.

However, some customers claim they received breach notifications despite purchasing their devices more than two years ago. On X, a user identified as “OG DEGEN” said they received a call from a scammer posing as law enforcement investigating fraud, suggesting the attacker had access to personal details tied to a Keystone order placed in 2024. The user said the caller referenced information specific enough to imply it came from the purchase, and the user suspected the scammer’s next step would involve convincing them that their private keys were exposed and then sending a phishing link.

Another X user, “trintaetres,” also said they received an email notification even though they bought the device more than two years earlier.

Keystone response and what remains unclear

Cointelegraph said it contacted Keystone to ask how customer information from purchases made more than 180 days earlier could have been exposed, given the company’s earlier retention-policy statements, and also requested how many customers were affected. Keystone did not respond by publication time.

Keystone’s public message acknowledged the impact and apologized to those affected, but the company did not disclose the number of customers impacted or provide additional technical detail about what specific systems or datasets were accessed beyond shipping and order information. That leaves an open question for affected users and the broader community: whether this event involved data outside the stated retention window, whether the retention policy operated differently in practice for some order records, or whether the exposed information was otherwise retained longer than customers expected.

Going forward, investors and users will want to watch for Keystone’s follow-up details on scope—especially whether it can clarify how older orders fit into its retention model—alongside any further security updates. For customers who received notifications, the immediate priority is to treat any follow-up messages, “support” emails, or links with heightened skepticism and verify claims through official channels.