Hardware wallet manufacturer Keystone confirmed a data breach after detecting unauthorized access to its official website. The company stated that attackers obtained customer shipping records, including names, contact information, home addresses, purchased products and prices.

Keystone detected the unauthorized access on October 20. After reviewing application programming interface activity with its e-commerce provider Shopify, the firm confirmed on October 23 that a third party had obtained the shipping information. The company issued a public apology and said it had blocked the access, corrected the vulnerability and launched an investigation.

What Information Was Exposed

The compromised records covered details collected during hardware wallet purchases. Keystone reported that the exposed data consisted of customer names, contact details, shipping addresses, ordered products and their prices. The company stated that recovery phrases, private keys, wallet passwords, payment card information and bank details were not compromised.

Keystone has begun notifying affected customers by email and said it plans to release a more detailed incident report. The firm has not disclosed the number of customers affected, the geographic distribution of the records or the precise method used to gain access.

Risks of Phishing and Physical Targeting

Although Keystone maintained that cryptocurrency credentials remained protected, the company warned that the leaked personal details could enable targeted scams. Potential attacks include messages or calls impersonating the firm with offers of refunds, replacement devices or requests to correct delivery information.

The company advised customers never to share recovery phrases or private keys and never to enter those phrases into devices they did not order. It urged users to contact official support channels only through its verified website when receiving unexpected communications.

Security specialist Taylor Monahan noted that the exposure of hardware wallet buyers’ home addresses creates risks of physical threats, including robbery or coercion commonly described as wrench attacks. No confirmed physical incidents linked to the Keystone breach have been reported.

Broader Context for Hardware Wallet Security

The incident follows earlier customer data exposures and other security problems reported by several hardware wallet makers during 2026. These include issues involving Coldcard, Ledger, Trezor and Safepal. In many of those cases the cryptographic security of the devices themselves was not broken, yet the release of personal and shipping information created openings for phishing and social engineering.

A comparable earlier event occurred in 2020 when Ledger disclosed unauthorized access to e-commerce and marketing records. That breach eventually involved hundreds of thousands of customer names, addresses and contact details, and the stolen information continued to surface in scam campaigns years later.

Former Binance chief executive Changpeng Zhao responded to Keystone’s announcement with a short public warning to remain cautious. Keystone continues to investigate the breach and has stated that it is contacting every affected buyer directly.