A top hardware wallet maker has suffered a serious customer data leak. Keystone revealed that an online attacker accessed records from its web shop. The breach leaked names and email addresses. It also leaked phone numbers. In addition, it leaked home shipping addresses. The leak has sparked strong anger among crypto holders. Keystone had promised for months that it deletes user shipping details.
Keystone builds physical tools to store digital coins safely offline. These units keep private keys away from web threats. The company uses an online shop to sell its gear. The shop runs on Shopify. Shopify is a major web service used by thousands of shops. On Saturday, October 24, 2026, Keystone posted a public alert. The firm said it spotted an intruder on October 20. Three days later, Keystone confirmed that the intruder stole customer order files.
The firm stated that secret crypto data was not touched. Attackers did not access private keys. They did not reach recovery seed words. Wallet passwords and bank card numbers remained safe. But the leak exposed shipping records. These records were very sensitive. The stolen data includes what hardware items customers bought. It also shows how much cash they spent on their units.
Keystone sent an apology to its community. Company leaders said they closed the security hole. They also opened a full review of their systems. Keystone warned customers to watch out for fake phone calls. They also warned about scam messages. Thieves might pretend to be support workers. They might offer fake refunds or replacement units. Keystone told users never to type seed words into any unverified unit. They urged users to check all incoming mail with great care.
The data leak caused heavy worry across the crypto world. Physical safety is a top concern for crypto owners. When home addresses leak, owners fear in-person attacks or home break-ins. These threats are known in crypto as wrench attacks. Thieves might use leaked addresses to target wealthy holders at their homes. Users buy hardware wallets to stay safe. They do not want to put their homes in danger.
Keystone had used privacy as a major selling point. Earlier this year, the company ran public ads promising strict data care. Keystone promised that customer shipping data gets erased for good after 180 days. In web posts, Keystone told buyers that other wallet makers keep data forever. Keystone claimed that it cleans records to keep users safe from harm.
However, several buyers said that Keystone failed to keep that promise. Customers posted proof that their old data was exposed anyway. One user shared that they bought a unit more than two years ago. Yet they received a breach notice this weekend. Another customer noted that their order was placed in early 2024. These reports show that Keystone kept customer records long past the 180-day mark. Many buyers feel misled by the firm’s claims. They want to know why old files were still kept on web servers.
The leak at Keystone follows similar events across crypto. In August, rival wallet maker Trezor reported a leak. The leak came through an outside shipping firm. That event hit tens of thousands of buyers. Shortly after, wallet firm SafePal found a software bug that leaked customer orders.
Keystone is working with outside security experts. The team is auditing its systems. The firm promised to share a detailed report soon. The event serves as a sharp reminder. Online shops hold valuable data. This data can put users at risk. Buyers must stay alert against phone and email scams. People should never share their private keys with anyone. Keeping personal data safe requires care. Users must always stay on guard. Everyone should watch out for phishing tricks.