Keystone, a maker of cryptocurrency hardware wallets, disclosed that an unauthorized third party obtained customer shipping information and order details from its online store that runs on Shopify. The company said it detected the intrusion on Oct. 20 and confirmed the data access after reviewing API activity with Shopify.
What was exposed and what was not
Keystone said the information taken included customers’ names, contact details, shipping addresses and order data such as the items purchased and their prices. The company wrote that financial payment information and sensitive cryptographic secrets were not accessed.
| Data type | Keystone's statement |
|---|---|
| Names, contact details, shipping addresses, order details | Exposed, according to Keystone |
| Payment cards and bank details | Not exposed, Keystone says |
| Recovery phrases, private keys, wallet passwords | Not exposed, Keystone says |
Keystone did not disclose how many customers were affected, how the attacker gained access, or whether the company has identified the intruder. The company said it has blocked access, patched the vulnerability, opened an investigation and begun emailing affected customers. Keystone said a more detailed report would follow in the coming days.
“You trusted us with those details, and we're sorry we didn't keep them safe,” Keystone wrote on X (formerly Twitter), adding that it had confirmed unauthorized access after “verifying API activity with Shopify.” — Keystone (X post, Oct. 25, 2026)
Why this matters to customers
Even when payment and cryptographic secrets remain secure, the theft of names, addresses and purchase history can enable targeted fraud. Keystone warned customers to be alert for scammers impersonating the company by phone, text, email or physical mail with offers of refunds, replacement devices or fixes for orders and addresses.
- Keystone said it would email people it believes were affected.
- The company urged customers not to enter recovery phrases into devices they did not order and to ignore links in unsolicited messages.
- Keystone had previously promoted a policy of deleting shipping data after 180 days, a claim it reiterated in posts earlier this year.
The incident follows a string of e-commerce and reseller-related disclosures in the hardware wallet industry earlier in 2026, when other vendors and their partners reported leak incidents tied to online stores and distribution channels.
Keystone attributed the exposed records to unauthorized access tied to activity on its Shopify-powered storefront. Shopify is a common e-commerce platform used by many merchants; Keystone said it verified API activity with Shopify while investigating the intrusion.
The company’s statement included consumer-facing guidance and a pledge of a fuller report. Keystone did not provide a timetable for the investigation or a count of affected customers in its initial disclosure.
