Quick answer: The Keystone data breach exposed customers’ names, contact details, shipping addresses and order details, the hardware wallet maker said on Oct. 24, 2026. A third party reached the data through its Shopify store after unauthorized access detected Oct. 20. Keystone says recovery phrases, private keys, wallet passwords and payment details were not exposed.
The Keystone data breach has put hardware wallet buyers’ home addresses in the hands of an unknown third party. Keystone, which makes air-gapped wallets that sign transactions by QR code, disclosed the incident on X at 17:59 UTC on Oct. 24, 2026, in a post that drew more than 238,000 views within three hours.
The company says no wallet was hacked. However, a leak of names and street addresses is exactly what phone scammers and phishing crews need, and some buyers say the calls had already started.
What happened in the Keystone data breach?
Keystone said it detected unauthorized access to its official website on Oct. 20, 2026. After checking API activity with Shopify, its e-commerce provider, it confirmed on Oct. 23 that a third party had obtained customer shipping information, according to the company’s statement on X.
The company said it has blocked the access, fixed the vulnerability, opened an investigation and started emailing affected customers. It has not said how many buyers are affected or how far back the exposed orders go. In replies on Oct. 24, Keystone said a detailed report would follow “in the coming days.”
What data was exposed and what stayed safe?
Per Keystone, the leak covers:
- Exposed: names, contact details, shipping addresses and order details, including items and prices.
- Not exposed: payment card or bank details, recovery phrases, private keys and wallet passwords.
The devices themselves were not involved. A hardware wallet keeps its keys offline, so a store database cannot reveal them. Crypto Briefing and Bitcoin.com News reported the same scope.
Were Keystone customers targeted before the disclosure?
At least one buyer says yes. On Oct. 23 at 23:18 UTC, X user @PEPE_Whale69 wrote that a caller using a spoofed Montreal police number tried to social-engineer them. The caller asked whether Keystone, Ledger or Trezor “meant anything,” and the details matched the user’s 2024 Keystone order. Keystone confirmed the breach about 19 hours later.
That claim comes from one user and has not been independently checked. It does match the pattern seen after past leaks, where attackers use real order data to make a fake call or letter feel official.
How does this compare with Ledger and Trezor leaks?
Hardware wallet makers have been hit at the store or support level before:
- Ledger, 2020: an attacker used a third-party API key to reach Ledger’s e-commerce and marketing database. When the data was dumped in December 2020, it held 1,075,382 email addresses and 272,853 order records with names, addresses and phone numbers, BleepingComputer reported. A separate Shopify insider incident affected about 292,000 Ledger customers, per Ledger’s FAQ.
- Trezor, January 2024: unauthorized access to a third-party support portal put up to 66,000 contacts at risk, and the attacker emailed 41 users asking for their recovery seeds, Trezor said.
As a result, Ledger customers spent years receiving fake device-replacement letters and phishing emails after their leak. Keystone buyers should expect the same playbook.
What should Keystone owners do now?
Your coins are only at risk if someone tricks you into revealing your recovery phrase. Keystone’s own advice, plus standard self-custody practice:
- Never share or type your recovery phrase, by phone, email, chat or web form. Keystone says it will never ask for it.
- Ignore “refunds,” “replacement devices” or address “fixes.” Keystone warned scammers may offer all three by phone, text, email or post.
- Never use a device you didn’t order. Keystone says not to enter your phrase on any unsolicited hardware. Our guide on checking whether a hardware wallet is genuine shows what to look for.
- Type the site yourself. Go to keyst.one directly rather than tapping links, and email support@keyst.one if something feels off.
- Think about physical safety. Your address is now linked to crypto ownership, so keep holdings private and consider a passphrase or multisig setup, covered in our self-custody wallet setup guide.
For the common scam scripts, see how to spot crypto scams and our report on fake wallet notifications hitting NGRAVE users.
Market implications
The breach does not affect any blockchain or token, so there is no direct price effect. The bigger issue is trust in self-custody brands. Each store-level leak gives rivals an opening and pushes buyers toward privacy steps such as buying with a pickup address or an alias.
Keystone Data Breach FAQ
Were Keystone wallets or seed phrases hacked?
No. Keystone said on Oct. 24, 2026, that recovery phrases, private keys and wallet passwords were not exposed. The leak came from its Shopify-based web store, not the devices.
What customer data did the Keystone breach expose?
Names, contact details, shipping addresses and order details such as items and prices, per Keystone. Payment card and bank details were not exposed.
How many Keystone customers were affected?
Keystone had not given a number as of Oct. 24, 2026. It said it is emailing affected customers and will publish a detailed report in the coming days.
Will Keystone ever ask for my recovery phrase?
No. Keystone says it will never ask for your recovery phrase or private keys. Anyone who does, by call, email, text or letter, is a scammer.
Not financial advice. This article is for information only. DYOR before making any decisions about your crypto.
Sources
- Keystone Hardware Wallet statement on X, Oct. 24, 2026
- Crypto Briefing: Keystone says website breach exposed customer data
- Bitcoin.com News: Keystone wallet data breach
- @PEPE_Whale69 post on suspicious call, Oct. 23, 2026
- BleepingComputer: Ledger owners’ addresses leaked (2020)
- Ledger: e-commerce and marketing data breach FAQ
- Trezor: security alert on support portal incident (2024)
