Keystone says website breach exposed hardware wallet buyers’ addresses

Hardware wallet maker Keystone says unauthorized access to its website exposed customers’ shipping addresses and purchase information, creating risks beyond the security of the devices themselves. The disclosure prompted warnings that identifying wallet buyers could leave them vulnerable to targeted scams and physical threats.

Keystone said it detected unauthorized access on October 20 and confirmed on October 23, after reviewing application programming interface activity with Shopify, that a third party had obtained customer shipping information. The exposed records included names, contact details, shipping addresses and order information, including purchased items and prices.

The company said payment card and bank details were not exposed, nor were recovery phrases, private keys or wallet passwords. That distinction separates the reported incident from a direct compromise of wallet credentials: the disclosed theft concerns customer records rather than the secrets used to control cryptocurrency.

Keystone said it had blocked the unauthorized access, fixed the vulnerability and opened an investigation. It also said it was emailing affected customers, although its initial disclosure did not specify how many buyers were involved, when the intrusion began or precisely how the attacker gained access.

The reference to Shopify describes activity Keystone examined while confirming the theft; it does not establish that Shopify’s underlying platform was compromised. The information released so far leaves unresolved which credentials, applications or website components were involved, limiting any assessment of the intrusion’s technical cause.

The immediate concern is that genuine purchase details can make fraudulent communications appear credible. Keystone warned that scammers could impersonate the company by telephone, text message, email or physical mail, offering refunds, replacement devices or supposed corrections to orders and delivery addresses.

Security developer Taylor Monahan, known online as Tay, warned that exposing hardware wallet buyers’ shipping information could also create physical dangers, including robbery and kidnapping, according to crypto.news. Those warnings describe potential consequences; Keystone’s disclosure does not establish that the stolen records have already led to physical attacks.

The incident highlights the difference between protecting cryptocurrency credentials and protecting the identity of someone who buys a wallet. An address linked to a purchase does not establish how much cryptocurrency a buyer holds, but it can give criminals a starting point for impersonation or coercion without defeating the device’s security.

Keystone urged customers not to share recovery phrases or private keys and not to enter a recovery phrase into a device they did not order. It also advised avoiding links in unexpected messages and reaching its website directly, rather than treating knowledge of an order as proof that a communication is genuine.

The company said a detailed incident report would follow as its investigation continued. That report is expected to provide the next opportunity to clarify the breach’s scope and cause, while affected buyers await direct notifications and further information about which records were accessed.