Keystone Says Data Breach Exposed Customer Addresses, Purchase Histories

Keystone, a hardware wallet maker for digital assets, said a security incident exposed customer personal data to an external party.

The Block reported on Oct. 25 that Keystone said on its official X account that unauthorized access to its online store exposed customers’ names, contact details, shipping addresses, purchased products and pricing information.

Keystone detected abnormal access on its official website on Oct. 20. On Oct. 23, while reviewing application programming interface activity on Shopify, it found that a third party had exfiltrated data. The company said payment card and bank account information, wallet recovery phrases, private keys and passwords were not compromised.

The company blocked the access route involved and fixed the security vulnerability. It is notifying affected customers by email. The exact number of affected users and the attack vector have not yet been identified. Keystone plans to release a detailed incident report after further investigation.

The breach has also raised questions about Keystone’s data retention policy. Keystone had said it permanently deletes shipping information 180 days after a product order. Some users, however, said they received breach notifications even though they had made their purchases more than two years earlier or 214 days had passed since their last order.

Another user said they received an impersonation call from someone who knew order details from a 2024 purchase. Those claims have not been independently verified, and Keystone has not given a detailed response on whether it complied with its 180-day data deletion policy.

Similar security incidents have recently hit the hardware wallet industry. In August, Trezor said a data leak at a shipping partner exposed information for about 14,000 customers. It later found that another 67,000 US customers were affected. SafePal has also said a flaw in its order lookup system exposed personal data for about 40,000 users.

Keystone said the exposed personal data could be used for impersonation scams and phishing attacks. It urged users to be cautious of contacts claiming to offer refunds, device replacements or order information changes, and not to click suspicious links or enter wallet recovery phrases.