Keystone Website Breach Exposes Customer Addresses and Order Details

Hardware-wallet maker Keystone said on Oct. 24 that unauthorized access to its website exposed customer names, contact details, shipping addresses and order information, warning that scammers could impersonate the company.

In its disclosure, Keystone said it detected unauthorized access on Oct. 20 and confirmed on Oct. 23, after checking API activity with Shopify, that a third party had obtained customer shipping information. The exposed order details included items and prices.

Payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed, the company said.

Keystone said it had blocked access, fixed the vulnerability, opened an investigation and was emailing affected customers. The notice did not disclose the number of affected customers, the period of unauthorized access or the date the fix was completed.

Order Data Creates Risks Beyond Wallet Access

The exposed records link names and delivery locations to specific purchases. That combination can make fake support messages more convincing and help identify potential physical targets, even without exposing the credentials needed to access a wallet.

Keystone warned that scammers could contact customers by phone, text, email or mail, offering refunds, replacement devices or supposed fixes for orders or addresses. It urged customers never to share recovery phrases or private keys, or enter a recovery phrase into a device they did not order.

The incident follows similar exposures affecting other hardware-wallet customers. Trezor's shipping-provider breach affected 80,689 customers, according to its updated disclosure. Trezor warned of phishing and potential physical-security risks, while saying parcel contents were not exposed.

SafePal disclosed an order-tracking plug-in flaw affecting approximately 39,798 customers who placed orders between March 2, 2025, and April 11, 2026. Exposed fields included names, email addresses, phone numbers, shipping addresses and purchase details, as The Defiant previously reported.

Keystone told customers to avoid links in unexpected messages and navigate to its website directly. In a follow-up reply, it said the investigation was continuing and a detailed report would be published “in the coming days.”