Keystone Hardware Wallet Users Exposed in Major Data Breach

Cryptocurrency hardware wallet manufacturer Keystone has confirmed a security breach that exposed sensitive customer information, including shipping addresses and contact details.

The company disclosed the incident on October 24, 2026, after detecting suspicious activity on its website earlier in the week.

Following an investigation involving Shopify, Keystone confirmed that an unauthorized third party had accessed customer shipping information through its website infrastructure.

The compromised records included customer names, contact information, delivery addresses and order details identifying purchased products.

The company apologized to affected users but did not disclose how many customers were impacted or the full extent of the compromised records.

Leaked Addresses Raise Physical Security Concerns

The breach has triggered concerns because hardware wallet customers may hold substantial cryptocurrency balances, making their personal information particularly sensitive.

Keystone warned that attackers could use the exposed information to conduct targeted phishing campaigns.

Criminals might impersonate customer support representatives or security investigators to persuade victims to reveal recovery phrases or approve fraudulent transactions.

Blockchain security researcher Taylor Monahan raised additional concerns about physical attacks targeting cryptocurrency holders whose residential addresses have been exposed.

These incidents, commonly known as wrench attacks, involve criminals using threats or violence to force victims to surrender digital assets.

According to blockchain security company CertiK, 52 verified wrench attacks occurred worldwide during the first half of 2026, compared with 39 during the same period in 2025.

That represents an increase of approximately 33%, highlighting the growing importance of protecting cryptocurrency holders' identities and locations.

Customers Report Suspicious Calls After Breach

Some Keystone customers have already reported potentially related phishing attempts involving their personal information.

An X user identified as OG DEGEN said they received a suspicious phone call from someone claiming to represent law enforcement.

The caller allegedly described a cryptocurrency fraud investigation and referred to personal information the user believed came from a Keystone purchase made in 2024.

The user suspected the caller intended to convince them that their private keys had been compromised before directing them to a fraudulent recovery website.

However, the connection between this reported incident and Keystone's confirmed breach has not been independently established.

The report nevertheless illustrates how exposed customer information can potentially support convincing impersonation attempts.

Keystone Faces Questions Over Data Retention

Beyond the immediate security incident, Keystone is facing questions about its previously announced customer data retention policy.

In 2023, the company stated that it had reduced the retention period for shipping information to 180 days.

The decision followed security incidents affecting other hardware wallet manufacturers and was intended to limit the amount of sensitive customer data retained.

Several customers reported receiving breach notifications despite purchasing their devices more than two years earlier.

One user, identified as trintaetres on X, said they received an email notification even though their purchase occurred well beyond the announced retention period.

These reports have raised questions about whether older customer records remained accessible or whether the notifications covered information stored through other systems.

Keystone has not publicly clarified the discrepancy.

Hardware Wallet Security Remains a Growing Concern

The incident highlights a distinction between hardware wallet security and the protection of customer information collected during purchases.

Hardware wallets are designed to keep cryptocurrency private keys isolated from internet-connected devices.

Even when private keys remain secure, leaked customer information can expose holders to phishing, impersonation and physical security threats.

The reported breach concerns Keystone's website and customer records, not a confirmed compromise of the hardware wallets themselves or their private keys.

Affected customers should remain cautious about unsolicited communications claiming that their recovery phrases or wallets require urgent verification.

Legitimate wallet support services should never require users to disclose their recovery phrases.

Investigation Continues as Customers Await Answers

Keystone says it has blocked unauthorized access, addressed the vulnerability and begun notifying affected customers.

Several important questions remain unanswered, including the number of affected users and the circumstances surrounding older customer records.

The company has not yet explained why customers whose purchases predated its stated retention window reportedly received breach notifications.

For now, the incident underscores the risks created when cryptocurrency ownership information becomes linked to identifiable customer addresses.

The investigation's findings will be important in determining the breach's full scope and whether additional protective measures are necessary.