Keystone Wallet Website Breach Exposes Customer Addresses and Orders
Keystone Hardware Wallet says unauthorized access to its website on October 20 exposed customer names, contact details, shipping addresses and order details. The company says keys, recovery phrases and payment data are safe, and warns of impersonation scams offering refunds or replacement devices.
Keystone Hardware Wallet says a third party accessed its official website on October 20 and walked away with customer shipping data. Disclosure came October 24. No recovery phrases or private keys were taken, according to the company.
In a post on X, Keystone said it confirmed the data loss on October 23, after verifying API activity with Shopify.
"We owe you an apology."
Keystone Hardware Wallet (@KeystoneWallet)
The exposed data covers customer names, contact details, shipping addresses and order details, including items purchased and prices. Keystone says payment card and bank details, recovery phrases, private keys and wallet passwords were not compromised.
Those assurances come from Keystone alone. The investigation is ongoing. A detailed report is due in the coming days.
Response and scam warning
Keystone says it blocked the access, patched the vulnerability and opened an investigation. It is notifying affected customers by email.
The leaked data is phishing fuel. Names paired with addresses and itemized orders give attackers a convincing script. Keystone warned that scammers could pose as company representatives offering refunds, replacement devices or help with orders and shipping addresses.
Its guidance to customers:
- Avoid unexpected links.
- Never disclose recovery phrases or private keys.
- Never enter a recovery phrase into a device you did not order.
Context
Keystone is a Hong Kong-based hardware wallet brand known for air-gapped, QR-code-based transaction signing. It supports multiple chains through integrations with MetaMask, Solflare, Keplr, Rabby and OKX Wallet.
It is not the only vendor dealing with customer-facing incidents. Trezor disclosed in August a customer data breach at its logistics provider ShipMonk. Ledger confirmed earlier this month that criminals modified genuine hardware wallets to steal recovery phrases and resold them through Southeast Asian resellers.
Our earlier coverage of a Trezor email provider breach showed where leaked customer contact data tends to lead: fake alerts landing in user inboxes.
