Keystone wallet breach exposes order data, not wallet credentials

What it is

Keystone, a hardware-wallet maker, said on 24 October 2026 that an attacker stole customer order records from its online store, which runs on Shopify. The records hold names, contact details, delivery addresses, products bought and prices. Keystone says payment cards, bank details, recovery phrases, private keys and wallet passwords were not exposed.

How it works

Keystone detected unauthorized website access on 20 October 2026. It confirmed the theft on 23 October after reviewing API activity with Shopify. The article states that this reference only identifies the evidence examined. It does not show that Shopify's platform was compromised. Keystone has not named the vulnerability, the number of people affected or how long the access lasted.

Preconditions / Affected

Anyone who ordered from Keystone's online store may be affected. Keystone has begun emailing affected customers. Security developer Taylor Monahan (Tay) warned that exposed shipping data could put buyers at risk of robbery or kidnapping. Order data can also make fake support messages more believable.

What to do

These are the steps Keystone gave customers:

• Never share a recovery phrase or private key with anyone.
• Never type a recovery phrase into a device you did not specifically request.
• Treat unexpected calls, texts, emails or postal mail as suspect, especially offers of refunds, replacement devices or order and address fixes.
• Avoid links in unexpected messages, go to Keystone's website directly, and report suspicious contact to official support.

Caveats

Keystone's retention statements conflict. Its Privacy Promise page says shipping information is removed automatically 180 days after an order. Its privacy policy, last updated in May 2021, instead describes deleting order information for customers who have not ordered in the previous 180 days. A help-center article says city and country records stay and that Shopify handles final deletion. Keystone promoted the 180-day deletion policy in posts in January, March and August 2026. The article does not say whether older orders were in the stolen data.

Keystone says its investigation is ongoing and promised a detailed report "in the coming days."

Two comparable cases are cited. Trezor's revised disclosure says a shipping-provider breach affected 80,689 customers, with parcel contents not exposed. SafePal disclosed an order-tracking plug-in vulnerability affecting about 39,798 customers who ordered between 2 March 2025 and 11 April 2026. The exposed data was names, email addresses, phone numbers, delivery addresses and purchase information.