Keystone Says Breach Exposed Hardware Wallet Buyers’ Addresses

Keystone, a well-known crypto hardware wallet manufacturer, disclosed that attackers accessed customer shipping information through a vulnerability affecting its website. The breach, first flagged as suspicious activity earlier in the week and confirmed after an internal review, has prompted Keystone to block access, fix the issue, launch an investigation, and contact affected customers.

According to Keystone, the exposed data included customer names, contact details, shipping addresses, and order information such as items purchased. The company did not specify how many customers were impacted.

Key takeaways

• Keystone said unauthorized access to customer shipping data was confirmed after reviewing API activity with Shopify.
• The company believes the incident could enable targeted phishing scams based on detailed order-related information.
• A security researcher warned that leaked shipping addresses can increase the risk of physical attacks against crypto holders.
• Customers have questioned Keystone’s older data-handling practices after some reported receiving breach notices despite purchasing devices more than two years ago.

What Keystone says happened

Keystone reported that it detected suspicious activity earlier in the week and later confirmed, on Friday, that an unauthorized third party accessed customer shipping information. In its statement, the company said it reviewed API activity with Shopify and determined that the breach involved order fulfillment details.

Keystone stated that it has blocked the unauthorized access, addressed the vulnerability, initiated an investigation, and is emailing customers it believes were affected. The company also reiterated regret for the disruption caused to those impacted.

While Keystone did not provide a customer count, the specific categories of data it disclosed—shipping addresses and order details—signal the breach could be more harmful than a general contact leak. Detailed order information can help attackers convincingly tailor messages, including “account verification” and “wallet security” lures that rely on real-world context.

Why the exposed data matters for real-world security

Keystone warned that the compromised information could be used in targeted phishing attempts. In parallel, security researcher Taylor Monahan raised a more severe concern: shipping addresses can increase the likelihood of physical intimidation or coordinated harassment.

That concern is not theoretical. Blockchain security firm CertiK recorded 52 verified “wrench attacks” worldwide in the first half of 2026, up from 39 during the same period in 2025, according to Cointelegraph’s reporting. “Wrench attacks” generally involve threats or violence aimed at forcing cryptocurrency holders to hand over assets.

With shipping addresses potentially tied to identifiable individuals and recent purchases, a breach like this can create the kind of targeting criminals need—especially if attackers can pair location details with knowledge about who has crypto hardware and when it was ordered.

Questions over retention of older customer information

Beyond the immediate breach, the incident has triggered scrutiny of Keystone’s data retention practices. In a 2023 blog post, Keystone said it reduced its customer data retention period to 180 days after security incidents affecting other hardware wallet manufacturers.

However, some customers on X reported receiving breach notifications even though they purchased their devices more than two years ago. One user, posting as “OG DEGEN,” said they received a call from a scammer who claimed the caller was law enforcement investigating fraud. The user suspected the scammer used personal details connected to a Keystone order placed in 2024, pointing to the plausibility of a targeted social engineering attempt leveraging the stolen information.

In the same thread of complaints, another X user, trintaetres, said they received an email notification despite buying the device more than two years earlier. The pattern suggests either that the breach involved records outside the timeframe Keystone previously described, or that Keystone may have retained some data longer than customers assumed.

Cointelegraph reported that it contacted Keystone for clarification on how information tied to purchases made more than 180 days earlier could have been exposed, and for an updated estimate of how many customers were affected. As of publication time, the company had not responded.

What to watch next

For customers, the immediate priority is to treat any message—especially those referencing past orders or device details—as potentially fraudulent unless it comes directly from Keystone through verified channels. For Keystone, the next crucial step is providing clarity on data retention and the scope of exposure, including whether older order records were involved despite the company’s stated 180-day policy. Readers should also monitor for additional security disclosures, customer support updates, and any guidance on how to recognize phishing attempts tied to the breach.