Keystone Wallet Breach: What Leaked Addresses Mean for Holders

Key takeaways

• Keystone said on Oct. 24, 2026 that a third party obtained customer names, contact details, shipping addresses and order details from its Shopify-powered online store.
• Keystone said payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed in the breach.
• Keystone's Privacy Promise says shipping information is deleted 180 days after an order, but several customers say they received breach notices for older orders, a claim Keystone had not addressed publicly.
• CertiK data cited by Cointelegraph recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 in the same period of 2025.
• Keystone has not disclosed how many customers were affected or how the attacker got in, and it has promised a detailed report in the coming days.

What Keystone has confirmed so far

The Keystone wallet breach became public on Saturday, Oct. 24, when the hardware wallet maker said on X that a third party had obtained customer shipping information from its Shopify-powered online store. According to the company, it detected unauthorized access to its official website on Oct. 20 and confirmed on Oct. 23, after checking API activity with Shopify, that customer data had been taken.

The exposed records include names, contact details, shipping addresses and order details, meaning which items were bought and at what price. Keystone said payment card and bank details, recovery phrases, private keys and wallet passwords were not involved. It says it has blocked access, fixed the vulnerability, opened an investigation and started emailing affected customers.

Much is still unknown. Keystone has not said how many people were affected, how the attacker got in, or whether it knows who is responsible. It told users it is still investigating and will publish a detailed report in the coming days. Cointelegraph reported that Keystone had not answered its questions on those points by publication time. Bitbase noted the company also has not said when the intrusion began. That matters because Oct. 20 is the date Keystone detected the access, which may not be the date it started.

Cointelegraph's timeline reads slightly differently from other outlets. It says Keystone confirmed the breach on Friday and announced it Saturday, and it describes the suspicious activity as spotted earlier in the week. That is consistent with the Oct. 20 and Oct. 23 dates, only less specific.

The 180-day deletion promise is now in question

The most contested part of the story is data retention. Keystone's Privacy Promise page says shipping information is automatically deleted 180 days after an order is placed, and company posts on X in January and March 2026 made similar claims. According to The Block, several customers say they were told their data was exposed even though their orders were older than that. One user said they bought a device more than two years ago and still received a breach email. Another said 214 days had passed since their last order.

These are customer accounts, and Keystone had not publicly responded to them as of Monday. If they hold up, the likely explanations are that deletion did not work as described or that the data sat somewhere outside the process the promise covered. Neither is confirmed, and I would not treat either as established until the company's report arrives.

Why an address leak matters for crypto holders

Nothing in the disclosure suggests funds are directly at risk. Seed phrases and keys were not exposed, and a hardware wallet's design does not depend on a retailer's customer database. The risk comes from the combination of data: a name, a home address, a phone number and proof that the person bought a crypto-specific device, with prices attached.

Keystone itself warned of targeted phishing. Scammers may pose as the company by phone, text, email or mail and offer refunds, replacement devices or fixes for orders and addresses. The company told customers never to enter a recovery phrase into a device they did not order and not to follow links in messages that claim to come from Keystone. A replacement device arriving unprompted, pre-seeded or paired with a convincing letter, is the kind of attack this data makes cheaper to run.

Security researcher Taylor Monahan went further, raising concern that leaked shipping addresses could expose customers to physical attacks and kidnappings. The backdrop is grim. Cointelegraph cites CertiK data showing 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 a year earlier. One X user, posting as OG DEGEN, said a scammer posing as law enforcement called them and that they suspect the caller used details from a 2024 Keystone order. That account is unverified, and no link to this breach has been shown.

A pattern across hardware wallet makers

Bitcoin.com reports that Keystone joins a list of hardware wallet makers with security problems this year, naming Ledger, Trezor, SafePal and Coldcard. Crypto.news adds that a claim of about 120,000 buyers' addresses exposed across four makers has not been checked against the companies' own disclosures, so that figure should be treated cautiously. For related background, see our earlier analysis of the SafePal breach and our look at the Coldcard X incident.

Market context and what to do

XPERTRAX data shows Bitcoin at $79,950, down 0.82% over 24 hours, and Ethereum at $2,316, down 1.29%. Those are modest moves, and nothing about them points to the Keystone news as a driver. A retailer-side data leak at one device maker is unlikely to shift prices by itself.

My view, which is analysis and not reported fact, is that the damage here falls on trust and personal security rather than on markets. Hardware wallets are sold on the idea that you hold your own keys, but the buying process still creates a record linking your identity, address and holdings-related purchase. Retailers that keep that record longer than promised turn a small privacy lapse into a safety problem.

Practical steps for anyone who bought a Keystone device, or any hardware wallet, from a direct web store:

• Treat unsolicited calls, texts, emails or parcels referencing a wallet order as hostile, including those claiming to be law enforcement or Keystone support.
• Never type a recovery phrase into any device or site you did not set up yourself.
• Verify the breach email by going to Keystone's official channels directly, not through links in the message.
• Avoid discussing holdings publicly and consider a forwarding address or locker for future hardware orders.

The report Keystone has promised should answer the open questions: scope, entry method, and why older orders appear in the data. Until then, assume the exposure is real and plan accordingly.

Sources

• Keystone customers say breach exposed data the hardware wallet maker promised to delete (theblock.co)
• Keystone says website breach exposed hardware wallet buyers addresses (cointelegraph.com)
• Keystone Wallet Data Breach Exposes Buyers' Addresses to Scammers (news.bitcoin.com)
• Keystone wallet hack exposes buyers' home addresses, sparking security fears (crypto.news)
• Keystone Wallet Hack Exposes Buyers' Home Addresses, Raising Security Concerns (bitbase.com)