Cryptoupdated 50m ago2 min read
Keystone Confirms Third Party Exfiltrated Customer Shipping Data From Online Store
“The fact that shipping addresses were leaked means attackers could trace victims’ homes, exposing them to kidnappings and torture.”
“warned that scammers could impersonate Keystone representatives and offer fake refunds, replacement devices or assistance with customer orders.”
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Unauthorized access on October 20 exposed customer names, emails, shipping addresses, and order details. Wallet recovery phrases, private keys, and payment data were not exposed.
Keystone Breach and Scope
Keystone disclosed that it detected unauthorized access to its online store on Oct. 20 and confirmed on Oct. 23 that a third party had exfiltrated customer shipping information.
Keystone said the exposed personal data included names, contact details, shipping addresses, and order details such as items and prices, while it said payment card and bank account information, wallet recovery phrases and private keys were not compromised.
Keystone also said it blocked the access route involved and fixed the security vulnerability, and it began notifying affected customers by email.
Keystone did not disclose the exact number of affected users or the attack vector, and it said it would release a detailed incident report after further investigation.
Keystone’s disclosure prompted questions about its data retention policy, because Keystone had said it permanently deletes shipping information 180 days after a product order.
Warnings of Scams and Violence
Keystone warned that the exposed information could be used for targeted phishing attacks and impersonation scams. Taylor Monahan warned that leaking shipping addresses could expose customers to physical attacks and kidnappings, and she tied the risk to the possibility of “wrench attacks.” CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 during the same period last year.
Keystone said, “We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” while it did not disclose how many customers were impacted. Keystone also urged users to be cautious of contacts offering refunds, replacement devices, or order information changes, and it told them not to click suspicious links or enter wallet recovery phrases.
Retention Disputes and Open Questions
Keystone’s breach raised questions about whether its 180-day deletion promise matched what some customers experienced, because some users said they received breach notifications even though they had made purchases more than two years earlier or 214 days had passed since their last order.
“The company did not respond by publication time.”
One user said they received an impersonation call from someone who knew order details from a 2024 purchase, and another user said they received the email notification despite buying the device over two years ago.
Keystone’s disclosure said it detected unauthorized access on Oct. 20 and confirmed the data theft three days later after reviewing application programming interface activity with Shopify, but it did not identify the attacker or the route used.
Keystone said it had reduced its customer data retention period to 180 days following security incidents affecting other hardware wallet manufacturers, yet it did not provide a detailed response on whether it complied with that policy.
Keystone said it plans to release a fuller incident report after further investigation, while it continued contacting affected customers by email.