On 24 October, Keystone published an apology that every hardware wallet company eventually dreads writing: a third party had obtained customer shipping information. The company says it detected unauthorised access to its official website on 20 October and confirmed the data theft on 23 October, after reviewing API activity with Shopify. It notified the public the following day at 17:59 UTC.

The detail that matters most is what did not leak. Keystone says payment card details, bank details, recovery phrases, private keys and wallet passwords were untouched. For a company whose entire pitch is that your keys never touch a networked device, that is the difference between a bad week and an existential one. But it would be a mistake to file this under “just marketing data”. The list that walked out the door is a map of people who own crypto, where they live, and what they bought.

The order of events

  • 20 October: Keystone detects unauthorised access to its official website.
  • 21 October: Keystone posts publicly about auditing its own supply chain and reseller controls in response to the Ledger implant case, calling it “a wake-up call for every hardware wallet maker. Us included.” The company was, by its own later timeline, already a day into an incident it had not yet confirmed.
  • 23 October: after verifying API activity with Shopify, Keystone confirms that a third party obtained customer shipping information.
  • 24 October, 17:59 UTC: public disclosure, apology, and a promise of a detailed report. Affected customers are being emailed.

What was taken, and what was not

Per Keystone, the exposed fields are:

  • Names
  • Contact details
  • Shipping addresses
  • Order details, including items purchased and prices

And, again per Keystone, not exposed:

  • Payment card or bank details
  • Recovery phrases
  • Private keys
  • Wallet passwords

Order details are the underrated item on that first list. A record saying someone bought a Keystone 3 Pro, paid a certain amount, and had it shipped to a residential address is not just a receipt. It is a targeting profile: this person self-custodies, owns at least one hardware device, has enough at stake to spend money on security, and can be located physically. Whoever holds that data does not need to break a secure element to make money from it.

We checked the store ourselves

Keystone’s wording refers to its “official website”, so we looked at where orders actually live. store.keyst.one returns a 301 redirect to shop.keyst.one; that storefront serves Shopify assets from cdn.shopify.com and returns Shopify’s shopify-complexity-score response header. The marketing site at keyst.one is a different application entirely, with x-powered-by: Express and no Shopify assets in the page.

That is consistent with Keystone’s own account: the company says it reviewed API activity with Shopify, and the customer records sit in the Shopify store, not on the device side. It also narrows what this incident is. Nothing here describes a firmware compromise or a key-extraction attack. It describes an attacker who reached order data through the e-commerce stack.

What we cannot see, and what Keystone has not described, is how that access was obtained: a leaked API credential, an over-permissioned integration, or a vulnerability in a connected app. Those are different failure modes with different lessons, and the promised report is the only place that answer should come from.

Why shipping data is the dangerous half

Hardware wallets solved one problem extremely well. Your keys stay offline, and a remote attacker cannot drain a wallet by compromising a website. What the industry did not solve is everything around the purchase: the store, the fulfilment vendor, the support inbox, and the marketing list.

The pattern is now well documented:

  • Ledger’s 2020 order database leak turned names, phone numbers and postal addresses into years of phishing, including physical letters that imitated official correspondence and pointed at a seed-phrase site. We walked through that pattern in our breakdown of hardware wallet scams.
  • In August 2026, Trezor disclosed a breach at its shipping provider ShipMonk, then said in September that roughly 67,000 more US customers were affected on top of the nearly 14,000 first reported (Trezor’s notice, The Block).
  • This month, Ledger confirmed that modified devices had reached buyers through resellers in Southeast Asia (our recap), which is the supply-chain version of the same problem.

Three different doorways, one building: the post-purchase relationship. A hardware wallet protects the key. It does not protect the customer record, and it certainly does not protect the person behind the record from social engineering or a wrench attack.

What Keystone has not said

  • How many customers are affected, or which order dates are in scope
  • What the vulnerable endpoint or credential was
  • Whether the third party is a known group, and whether the data is being traded
  • Whether order data retention will change
  • Whether the attacker also saw support conversations or other records

Keystone says a detailed report is coming. Until it does, the honest position is: scope unknown, vector unknown, buyer unknown.

What to do if you bought from Keystone

  1. Do not trust inbound contact. Assume any call, text, email or letter claiming to be Keystone is hostile until verified. Type keyst.one into your browser yourself; do not click links in unexpected messages.
  2. Never share a recovery phrase. No support agent, auditor, exchange, or “security team” needs it. This is the one rule that cannot be negotiated with.
  3. Never initialise an unsolicited device. If a replacement or “fixed” unit arrives that you did not order, do not set it up and do not generate a seed on it. Contact Keystone through the official site first.
  4. Verify firmware from the official source. Keystone publishes firmware and verification steps at keyst.one/firmware. If a device’s firmware cannot be verified, stop.
  5. Reduce address exposure going forward. For future hardware purchases, consider a parcel locker, an office address, or a forwarding service. Assume the address attached to a crypto purchase is public forever.
  6. Harden the email you used. Unique password, app-based two-factor or a passkey, and no SMS-only protection on accounts tied to exchanges or self-custody.
  7. Expect the follow-up scam, not just the phishing email. The valuable play here is a “replacement device” or a “refund form”, not a fake login page. Both are ways to get either your seed phrase or a tampered signer into your hands.
  8. Tell the people who live with you. Physical-risk scams work better when only one person in the household knows what is going on.

The industry’s real weak point

Every hardware wallet vendor says the right things about key security. Very few treat customer data as radioactive. Order records get copied into analytics, helpdesk tools, email platforms and fulfilment systems, and then they sit there for years because deleting them requires effort and nobody is rewarded for it.

A mature policy looks boring: purge shipping data shortly after delivery, separate fulfilment identity from marketing identity, keep only what warranty and tax rules require, and publish the retention window. Keystone’s device design was not the failure here. Its data handling was. Until that changes across the industry, buying a hardware wallet will keep doubling as an entry in someone’s target list, and the phishing will keep arriving with your real order number attached.

If you take one thing from this: your seed phrase is still yours, and that is genuinely good news. Your name, your street and the fact that you own a hardware wallet are now somebody else’s problem to exploit.

Frequently Asked Questions

Were Keystone private keys or recovery phrases stolen in this breach?

Not according to Keystone. The company says the exposed data is customer names, contact details, shipping addresses and order details including items and prices. Payment card details, bank details, recovery phrases, private keys and wallet passwords were not part of it. Nothing in the disclosure suggests the attacker reached a device, a firmware build or a signing key.

What exactly did the attacker take?

Names, contact details, shipping addresses, and order details such as which items were bought and what they cost. Order details are the part people underestimate: they tell a stranger that you own a hardware wallet, which model, how many units, and roughly how much you spend on self-custody gear.

How many Keystone customers are affected?

Keystone has not said. It says it is emailing affected customers and that a detailed report will follow. Until that report lands, treat the scope as unknown rather than small.

Does this mean Keystone devices or firmware are compromised?

There is no evidence of that in Keystone's statement. The company describes unauthorised access to its website and API activity with Shopify, which points at the e-commerce layer, not the air-gapped signer. Still, verify firmware through the official site and never initialise a device that arrived without you ordering it.

What should I do if someone contacts me about a Keystone refund or replacement?

Treat it as a scam until you have independently verified it. Type keyst.one or shop.keyst.one into your browser yourself, contact support@keyst.one, and never share a recovery phrase, install remote-access software, or accept a replacement device you did not order. Keystone says it will never ask for your recovery phrase.