Keystone Customer Data Breach Exposes Addresses and Order Details

Hardware-wallet maker Keystone disclosed a customer data breach on Saturday, saying unauthorized access to its website exposed personal information and purchase records. The company said recovery phrases and private keys remained secure, distinguishing the customer-data exposure from a compromise of the credentials used to control cryptocurrency.

According to Bitcoin.com News, the exposed information included names, shipping addresses, contact information and purchase details. Those records could give scammers information about people who bought hardware wallets, although the disclosure does not establish how much cryptocurrency any individual customer holds.

Coin Edition separately reported that Keystone detected unauthorized access on October 20 and confirmed the exposure on October 23 after checking API activity with Shopify. That account places the public disclosure on October 24, 2026. The involvement of API activity does not, by itself, establish that Shopify’s own systems were breached.

Keystone’s published privacy policy confirms that Shopify powers its online store and that order records include customer contact and delivery information. The policy describes its hardware wallets as offline products through which it does not collect customer information. These are distinct parts of the business, with different security implications when information is exposed.

That distinction matters because protecting wallet credentials does not eliminate the risks created by leaked customer records. A message containing a real name, delivery address or purchased product could appear more convincing than a generic scam. Such details could be used to support false claims about an order, refund or device replacement.

The potential danger is therefore not limited to the information already obtained. A scammer could try to use that information to persuade a customer to disclose additional secrets. The reported exposure should not be read as evidence that private keys were stolen, but Keystone’s assurance about those keys also does not make unsolicited follow-up messages trustworthy.

Keystone’s privacy policy explicitly says the company will never ask customers for a seed phrase or private key. It also warns against sharing recovery phrases, passwords or other sensitive wallet credentials with its AI customer assistant. Those published boundaries provide a way for customers to assess requests that purport to come from support.

Coin Edition reported that Keystone blocked the unauthorized access, fixed the vulnerability and began notifying affected customers. It also reported that the company advised users to avoid unexpected links and visit its website directly. These measures address containment and communication, but do not establish that any information already obtained has been recovered or deleted.

The material available for this report does not establish the number of affected customers, the full period covered by the exposed orders or the identity of the unauthorized party. Coin Edition reported that Keystone planned a more detailed account in the coming days. That report will be important in clarifying the scope of the incident and the technical circumstances behind it.