Hardware wallet maker Keystone says an unauthorized party reached customer names, contact details, shipping addresses and order contents. Some buyers say their records were older than the company's stated 180-day retention window, which raises questions about data deletion.
Keystone says attackers reached customer order records
Keystone, a maker of crypto hardware wallets, has disclosed that an unauthorized third party accessed customer information through its website. According to Cointelegraph, the company said on Saturday that it had noticed suspicious activity earlier in the week. It confirmed the unauthorized access on Friday after reviewing API activity together with Shopify.
Cointelegraph reported that Keystone has shut off the attackers' access, patched the flaw, started an inquiry and begun notifying affected customers by email. It also apologised to those affected. Keystone has not said how many customers were impacted, and Cointelegraph reported that the company did not respond to its questions before publication.
What was exposed, and what the company says was not
The exposed records are the kind generated every time a customer buys a physical device online. Cointelegraph listed the categories below, and the summary from The Defiant adds the company's statement about what stayed out of reach.
- Names and contact details of customers.
- Shipping addresses.
- Other order details, including the items bought.
- The Defiant relays Keystone's statement that none of its customers' payment data, recovery phrases or private keys was accessed.
A retention promise comes under scrutiny
The breach has also reopened a question about how long Keystone keeps buyer information. Cointelegraph noted that a 2023 blog post from the company said it had cut its customer data retention period to 180 days. The company made that change after security incidents hit other hardware wallet makers.
Some customers now say they received breach notifications even though they bought their devices more than two years ago. If those notices are accurate, older order records may not have been deleted as described. Cointelegraph asked Keystone how purchases older than 180 days could have been exposed, and the company had not answered by publication time.
How the three outlets' accounts fit together
The three outlets describe the same incident from different angles. Cointelegraph provides the fullest account, including the timeline, the company's quoted response, the researcher's warning and the customer reports. Its text is the only one of the three that was available in full.
The Block focuses in its summary on the retention issue. It says Keystone has stated that it deletes customer information 180 days after orders in most cases, while X users have cast doubt on that claim. The Defiant stresses the company's assurances, namely that access was blocked, the flaw was fixed and no payment details, recovery phrases or private keys were exposed.
The accounts do not conflict, but they emphasise different things. The reassurance about keys and recovery phrases comes from Keystone itself, and the outlets' summaries do not describe any independent check of it. The retention doubts rest, so far, on individual customer reports posted on X.
Why a leaked shipping address is more than a spam risk
Keystone warned that the exposed details could feed targeted phishing. Cointelegraph described one X user, writing as "OG DEGEN", who received a call from someone posing as law enforcement. The user suspected the caller had drawn on a Keystone order placed in 2024. The user wrote that the likely aim was to persuade them their keys were compromised and then direct them to a phishing link presented as a reset tool.
Security researcher Taylor Monahan went further, cautioning that home addresses in the leak might put customers at risk of physical attacks, including kidnapping. Cointelegraph placed that concern against figures from CertiK. CertiK's tally for the first six months of 2026 stands at 52 confirmed wrench attacks globally, a 33% rise from 39 a year before. Wrench attacks use physical threats or violence to force holders to hand over their crypto.
A list of buyers of a crypto hardware wallet is valuable to criminals because it identifies people likely to own digital assets. Pairing names with home addresses and purchase details makes that list far more useful than an email database alone.
Open questions for customers and the company
Several points remain unresolved. Keystone has not said how many people are affected, how the attackers got in, or why records older than its stated retention window were apparently still held. Whether the notifications going to long-time buyers reflect retained data, as some customers suspect, is not confirmed by the company.
Customers who receive a notice from Keystone can treat unsolicited calls, emails and messages that mention their device or order with caution. A caller who knows an order detail is not proof of legitimacy. Nobody legitimate needs a recovery phrase or a private key, and the company says those were not exposed. Further statements from Keystone on scope and data deletion would show whether the investigation it opened produces more detail.
Market snapshot
| Asset | Price | 24h | 7d | Market cap |
|---|---|---|---|---|
| Bitcoin (BTC) | $80,038 | -0.6% | -3.2% | $1.61 trillion |
| Ethereum (ETH) | $2,318 | -1.2% | -4.6% | $283.16 billion |
CoinGecko data as of 2026-10-26 (UTC).
FAQ
What information did the Keystone breach expose?
Cointelegraph reported that an unauthorized party reached what customers had provided when ordering: who they are, how to reach them, where goods were sent and what they bought. The Defiant reported Keystone's statement that payment data, recovery phrases and private keys were not accessed.
Why are Keystone customers questioning the company's data retention?
Keystone said in a 2023 blog post that it had reduced its retention period to 180 days. Some customers who bought devices more than two years ago still received breach notifications, which suggests older records may have been kept. The company had not answered questions on this at publication time, according to Cointelegraph.
Why do leaked shipping addresses worry security researchers?
Researcher Taylor Monahan warned that the addresses could expose holders to physical attacks as well as scams. Per CertiK, confirmed wrench attacks globally reached 52 in the first six months of 2026, compared with 39 a year before.
Sources
- Cointelegraph: Keystone says website breach exposed hardware wallet buyers’ addresses (2026-10-26)
- The Block: Keystone customers say breach exposed data the hardware wallet maker promised to delete (2026-10-25)
- The Defiant: Keystone Website Breach Exposes Customer Addresses and Order Details (2026-10-24)
- CoinGecko (market data)
Written by the Coinvote news desk from reporting by Cointelegraph, The Block and The Defiant. Not financial advice.
