Keystone Data Breach 2026: What Leaked and the Hardware Wallet Self-Defence Checklist
On 24 October 2026 Keystone apologised for unauthorised access to its website, detected on 20 October and confirmed on 23 October after reviewing Shop…
On 24 October 2026, hardware-wallet maker Keystone posted an apology on its official X account: it detected unauthorised access to its website on 20 October and, after verifying API activity with Shopify on 23 October, confirmed that a third party had obtained customer shipping information. The exposed data includes names, contact details, shipping addresses and order details such as the items purchased and their prices. Payment card details, bank information, recovery phrases, private keys and wallet passwords were not exposed.
The detail is uncomfortable for hardware-wallet users: the device protected the private key, while the order database handed over who you are, where you live and how much you spent on the device. No coins were stolen, but targeted phishing and physical-security risk are real.
The short version: no keys lost, but identity, address and order value leaked
Start with the point most likely to be misread: this was not a private-key leak and not a device compromise. Keystone’s selling point is a fully air-gapped device that signs transactions via QR codes and never connects over USB, Bluetooth or Wi-Fi. The company says payment cards, bank details, recovery phrases, private keys and wallet passwords were outside the exposed data set.
Shipping data is still more valuable than many people assume. With a name, email or phone number, a delivery address and confirmation that the person bought a Keystone device at a certain price, an attacker can build a very convincing phishing message:
- Posing as Keystone support and claiming the order was affected by the breach, with a link to “verify identity” or “request a refund”.
- Sending an “official replacement device” and asking the user to import the old recovery phrase to migrate.
- Claiming the address is wrong and asking for more personal data to “reconfirm delivery”.
- Using high-value order records for phone harassment, parcel interception or even physical targeting.
The correct response is not to panic-sell. It is to treat the purchase-data leak as the starting point of a social-engineering campaign.
What Keystone has confirmed — and what it has not
Based on Keystone’s public statement and cross-checks by multiple outlets, the confirmed facts are:
- 20 October: unauthorised access to the official website was detected.
- 23 October: after reviewing API activity with Shopify, Keystone confirmed that a third party had obtained customer shipping information.
- Exposed fields: name, contact details, shipping address and order details (items and prices).
- Not exposed: payment card and bank details, recovery phrases, private keys and wallet passwords.
- Response: access was blocked, the vulnerability patched, an investigation opened, affected customers notified by email, and a detailed report promised in the coming days.
Not yet public: the exact number of affected customers, whether all historical orders are included, the full scope of phone and email fields, and the technical nature of the vulnerability. The company says the investigation is ongoing, and the follow-up report is worth watching.
Why hardware-wallet makers keep failing on purchase data
This is not unique to Keystone. It is a structural weak point in the hardware-wallet industry: the harder the device security, the more likely the e-commerce, logistics and support systems become the soft target.
- August 2026: Trezor disclosed a data breach at logistics partner ShipMonk affecting about 67,000 US customers.
- October 2026: Ledger confirmed that criminals had modified genuine hardware wallets, implanted firmware that steals recovery phrases, and resold them through Southeast Asian resellers (see our Ledger supply-chain attack report).
- October 2026: Keystone’s website order system was accessed without authorisation, exposing customer shipping data.
All three share one pattern: when attackers cannot reach the on-chain private key, they go after the person — using real order data to build trust, then convincing the user to hand over the recovery phrase or buy a tampered device. The defence therefore extends beyond the device to purchase channels, delivery methods and the source of every message.
The self-defence checklist: six steps
- Treat every unexpected contact as phishing. Any email, text or DM claiming to be Keystone and mentioning a refund, replacement, order problem or address verification should not be clicked. Open the official website or official X account yourself and verify there.
- Never enter a recovery phrase into a website or chat. No vendor, support agent, police officer or platform will ask for it. Anyone telling you to “import to verify”, “migrate the wallet” or “unlock compensation” should be cut off immediately. The phrase belongs only on your own device.
- Reject unsolicited “replacement devices”. Do not accept a device you did not request. Buy only from the official site or authorised resellers, and verify firmware and signatures using the official guide before first use.
- Find official support yourself. Open a ticket through the official help centre or the channel listed on the official X account. Do not use contact details from the email. Keep the order number and all correspondence.
- Improve delivery-data hygiene. For future orders, use a parcel locker or pickup point, an email alias and a separate delivery phone number. Do not keep receiving high-value devices at the same address.
- If you entered a recovery phrase on a suspicious page, move the funds now. Send the assets to a new wallet and retire the old one. Do not wait for the official report. For the basics, see our recovery phrase and private-key guide.
Can you still use a hardware wallet?
Yes. This incident did not involve device firmware, the signing flow or private keys, and Keystone’s air-gapped signing logic was not broken. What needs adjusting is purchase and communication hygiene, not a move back to exchange custody.
For larger balances, split the risk: a hot wallet for small day-to-day amounts, a hardware wallet for savings, and in extreme cases multisig or two independent wallets. Do not concentrate everything on one device and one recovery phrase. For device selection and backup, see our wallet selection guide; for compromised approvals and recovery, see the approval cleanup playbook.
FAQ
Can my coins be stolen?
According to the disclosure, private keys, recovery phrases and wallet passwords were not exposed and the device was not compromised, so this leak alone cannot move your assets. The real risk is phishing: attackers use genuine order data to convince you to hand over the recovery phrase or use a tampered device.
Should I move my assets immediately?
Only if you exposed a recovery phrase on a suspicious page or chat, or if the purchase channel was untrustworthy and the device may have been modified. An order-data leak alone does not justify a panic transfer, but every subsequent “official” contact should be treated as high-risk.
Will Keystone contact me to verify my wallet?
No. Any contact asking for a recovery phrase, private key or wallet password, or asking you to “import the wallet to verify” on a website or app, is a scam. Official notices only direct you to the official site or app.
How do I tell whether an email is genuine?
Ignore the display name and check the full domain. Do not click links in the email; open the official website manually and compare with the help centre or the official X account. Official announcements usually appear on both the website and X.
Can I still buy Keystone devices?
Yes, but only from the official site or authorised resellers, with delivery to a locker or pickup point, and verify the firmware before first use. A purchase-data breach is an e-commerce problem, not proof that the device security failed.
Risk notice: This article summarises a security incident and provides operational guidance; it is not investment advice. Details should be checked against Keystone’s official statement and follow-up investigation. Crypto assets are highly volatile; assess your own risk. Any request for a recovery phrase, private key or wallet password should be treated as fraud.
