Keystone, a maker of cryptocurrency hardware wallets, said an unauthorized party accessed customer shipping information through its website, exposing data that could be used in targeted scams and potentially put some crypto holders at physical risk.
What Keystone disclosed
The company said it detected suspicious activity earlier in the week and, after reviewing application programming interface activity with Shopify, confirmed on Friday that a third party had accessed customer information. Keystone disclosed the incident on Saturday.
The information included customers’ names, contact details, shipping addresses and other order information, including the products purchased. Keystone said it had blocked the unauthorized access, fixed the vulnerability and opened an investigation. It also said it was contacting customers believed to be affected by email.
The company did not say how many customers were impacted. In a statement, Keystone apologized to those affected and warned that the exposed information could be used in targeted phishing campaigns.
A hardware wallet is a physical device designed to store or help protect the private keys used to control cryptocurrency. Because ownership of a device can indicate that a person holds digital assets, a customer database containing names and addresses may be more sensitive than an ordinary retail order list.
According to Cointelegraph, security researcher Taylor Monahan warned that the consequences could extend beyond online fraud. Monahan said the disclosure of shipping addresses could expose customers to physical attacks and kidnappings. The concern is linked to so-called “wrench attacks,” in which criminals use physical threats or violence to force cryptocurrency holders to surrender their assets.
CertiK, a blockchain security firm, recorded 52 verified wrench attacks worldwide during the first half of 2026. That was 33% higher than the 39 attacks recorded during the same period a year earlier, according to the source material.
The available information does not establish that anyone whose data was exposed has suffered a physical attack. It does, however, underline why details connecting a person to a crypto product can create risks beyond conventional phishing or identity-based scams.
Customers question data-retention policy
The incident has also prompted questions about how long Keystone kept older customer records.
In a 2023 blog post, Keystone said it had shortened its customer-data retention period to 180 days. The company made that change after security incidents involving other hardware-wallet manufacturers.
Some customers said they received breach notifications even though they had bought their devices more than two years earlier. Their reports have raised questions about whether older order details were deleted as Keystone had indicated, or whether the notifications reflect information retained beyond the stated 180-day period.
One X user, identified as “OG DEGEN,” said a caller claiming to be law enforcement had contacted them about an alleged fraud case. The user suspected the caller had obtained personal information from a Keystone order placed in 2024, based on details mentioned during the call.
The user said the apparent objective may have been to persuade them that their private keys had been compromised and then direct them to a phishing link presented as a way to reset those keys. Another X user, trintaetres, said they too received a notification despite purchasing a device more than two years earlier.
The reports are customer claims and do not by themselves confirm how the information was obtained. They have nevertheless intensified scrutiny of Keystone’s previous data-retention statement.
Cointelegraph said it asked Keystone how information from purchases more than 180 days old could have been exposed and how many customers were affected. The company had not responded by the time of publication.
What the disclosure means for customers
The breach illustrates two separate risks for hardware-wallet buyers. First, exposed contact and order details can support convincing phishing attempts. A scammer who knows a customer’s name, address and purchased product may be able to make a fraudulent message appear more credible.
Second, shipping information can reveal where a person connected with cryptocurrency hardware lives or receives deliveries. That is why security researchers have highlighted the possibility of physical intimidation, although the source material does not report a confirmed physical attack resulting from this incident.
Keystone said it had taken technical steps to block access and repair the vulnerability, but it did not provide further details about the flaw, the attacker or the full scope of the investigation. It also did not publish a figure for affected customers.
Moneyiar market picture
Moneyiar market data at 2026-10-25 22:38-22:39 +03:30 showed mixed moves among the listed assets:
- AKEDO (AKE) was priced at $0.031015752, up 0.8% over 24 hours and 2.5% over seven days.
- AI Rig Complex (ARC) stood at $0.0594624188, down 3.6% over 24 hours but up 46.65% over seven days.
- Walrus (WAL) was $0.0343190471, down 0.3% in 24 hours and 11.97% over seven days.
- ONEchain (ONE) was $0.1019913497, down 0.44% over 24 hours and up 1.74% over seven days.
These market movements are separate from the Keystone security incident and do not indicate any effect from the breach.
