Mentioned in This Article
1. Keystone wallet data breach: what the company disclosed
Keystone, the Hong Kong-based maker of self-custody hardware wallets, said on October 24 that an unauthorized party had gained access to its official website. The company detected the intrusion on October 20 and confirmed three days later that customer shipping information had been taken. Names, contact details, delivery addresses and order records were exposed.
The announcement came in a public post from the company's official account, which opened with an apology to customers. Keystone described the episode as a website compromise rather than a flaw in its devices, and it stressed that nothing needed to secure a wallet itself was reached. The company said it has closed the access route, patched the weakness and begun an investigation.
For a business whose entire pitch is protecting the keys that control digital assets, a leak of customer records is an awkward event even when the keys are safe. The episode shows that the weak point in self-custody is often not the device on the desk but the retail machinery around it: the store, the checkout system and the databases that record who bought what.
2. What customer information was exposed?
According to Keystone, the exposed material falls into four groups: customer names, contact information, shipping addresses and order details. Order details cover which products a person bought and what they paid for them. Together, those fields amount to a fairly complete picture of a buyer: who they are, where they live, how to reach them and what they spent on a crypto security product.
That combination matters more than any single field. A name and an email address alone are common in breaches and are mostly a nuisance. A name tied to a home address and to the knowledge that the person owns a hardware wallet is different, because it identifies someone as a likely holder of digital assets. Criminals who run targeted phishing campaigns value exactly that kind of list, since it lets them skip the guesswork and write convincing messages to people who are known to have something worth stealing.
Order details deserve particular attention. Knowing the exact model purchased and the price paid lets a fraudster write a message that sounds like a genuine customer-service follow-up, referring to a real product and a real amount. That specificity is what turns a generic phishing attempt into a believable one, and it is why Keystone paired its disclosure with such a pointed warning about impersonation.
Keystone has not said, in the details available so far, how many customers are affected or what technical weakness the intruder used. The company is notifying those concerned by email, so customers who bought through the official site should watch their inboxes, and should treat unexpected messages that claim to come from the company with care.
3. What was not compromised?
Keystone states that payment card details, bank details, recovery phrases, private keys and wallet passwords were not compromised. In plain terms, the company says that the intruder could not move funds from any wallet and did not obtain the means to pay for anything with a customer's card.
That claim is consistent with how the product is designed. A hardware wallet keeps the private key inside the device, and the key is never meant to touch the internet-connected systems of the seller. A website database, even a badly exposed one, is not supposed to contain that secret at all, because the manufacturer never sees it. Recovery phrases are generated on the device by the owner, written down offline and never transmitted to the vendor.
Payment details are usually handled by an outside payment processor rather than stored by the merchant, which is the likely reason card and bank information sat outside the reach of the intruder. Keystone did not spell out that mechanism, so the point remains an inference about common practice rather than a statement from the company.
4. How did the incident unfold?
The timeline Keystone gave is short. On October 20, the company detected unauthorized access to its official website. It then reviewed application programming interface activity together with Shopify, the commerce platform behind its storefront. On October 23, that review confirmed that a third party had obtained customer shipping information. The public disclosure followed on October 24.
An application programming interface, or API, is the channel through which software systems exchange data, for example when a storefront passes order information to the platform that processes it. By checking API activity with Shopify, Keystone was able to see what the unauthorized party had requested and conclude that shipping records were among the data retrieved.
The gap between detection and confirmation, three days, is typical of incident response. Teams must first establish that an intrusion is real, then work out which records were reached, and only then decide what to tell customers. Announcing too early risks inaccurate claims, while waiting too long leaves people exposed to scams, so the sequence Keystone describes reflects the usual trade-off.
Once the scope was clear, the company blocked the access, fixed the vulnerability, opened a formal investigation and started contacting affected customers. It also promised a detailed report in the coming days, which should explain more about how the intruder got in and how far the access went.
5. Why is the scam warning part of the announcement?
Keystone used the disclosure to warn customers about impersonation. The company said scammers may approach people by phone call, text message, email or even letter, posing as Keystone staff and offering refunds, replacement devices or help with orders and shipping addresses. Those pretexts are plausible precisely because the attackers now hold genuine order data and can quote real purchases back to the victim.
The company's advice was direct. Customers should avoid unexpected links and should never give a recovery phrase or a private key to anyone, whatever the reason offered. Keystone added that a recovery phrase should never be typed into a device the customer did not order. That last point targets a known fraud pattern in which a victim receives an unsolicited or swapped wallet that has been prepared by the criminal, and is then persuaded to set it up and store funds on it.
The practical rule that follows is simple. A genuine vendor will not ask for a recovery phrase under any circumstances, because the phrase is the wallet. Any message that requests it, however official the letterhead or however accurate the order details, is an attempt at theft.
6. About Keystone and its air-gapped design
Keystone is known for a fully air-gapped design in which transactions are signed through QR codes. The device has no USB data connection, no Bluetooth and no Wi-Fi, so the keys stay offline and a transaction is passed in and out by scanning images rather than by any wired or wireless link. The aim is to remove the digital pathways through which malware could reach the keys.
The brand began with a focus on Bitcoin and has since grown into a multichain wallet. It supports Ethereum and other EVM-compatible networks, Solana, Polkadot and Cosmos, and it works with software wallets and interfaces including MetaMask, Solflare, Keplr, Rabby and OKX Wallet. That breadth means its customer base is spread across several ecosystems, which also widens the range of people who could be targeted by follow-up scams.
The air gap protects the signing process. It does nothing for the data held by the company's online shop, and this incident is a reminder that the two are separate layers. A device can be well designed while the surrounding commerce systems remain exposed to ordinary web attacks.
7. A recurring problem for hardware wallet makers
Keystone is not the first maker in the sector to face a customer-data incident. Trezor and Ledger have also dealt with security events that affected customers, and the pattern is familiar: the devices themselves hold up, while records kept by stores, logistics partners and other third parties leak. For the buyer, the result is the same, a list of known crypto holders in the wrong hands.
The structural reason is that selling a physical product requires collecting personal data. Shipping a box means holding a name and an address, and every processor, courier and platform that touches that data adds another place where it can be lost. Privacy-minded owners often try to limit the exposure by using separate contact details for hardware purchases, though that cannot be fixed by the customer alone once the vendor's own systems are breached.
The risk is not only digital. Because shipping data ties a person to a home and to crypto ownership, it can raise concerns about physical targeting as well as online fraud. Keystone has not suggested that any such threat exists, but the combination of address and ownership is the reason security specialists treat this type of leak seriously.
8. What happens next?
Keystone says a detailed report is due in the coming days. It should clarify how many customers were affected, what weakness was exploited and whether any further data was reached. Until it arrives, those figures remain unknown.
Customers who purchased through the official site can take a few steps in the meantime. They can look out for the company's notification email, ignore calls, texts and letters that offer refunds or replacements, and confirm any claimed contact from Keystone through its official channels rather than through details supplied by the message itself. Keeping the recovery phrase offline and unshared remains the single most important safeguard, and Keystone says that nothing in the breach touched it.