On this page
Key takeaways
- Hardware wallet maker Keystone says someone got unauthorized access to its official website, spotted on October 20. On October 23, after checking API activity with Shopify, it confirmed that a third party had taken customers' shipping information.
- Keystone says the intruder got buyers' names, delivery addresses, ways to contact them, and what each person ordered and paid. It says no recovery phrases, private keys or wallet passwords were taken, and no card or bank information either. It hasn't said how many customers were affected.
- The danger now is targeted scams: fake refunds, "replacement" devices and support calls aimed at people the scammers know own a hardware wallet. Never share or type your recovery phrase because of a message, and never use a device you didn't order.
Keystone, a maker of air-gapped hardware wallets that sign transactions by QR code, says an outsider got into its online store and took customers' names, addresses and order details. The company says nobody's coins or recovery phrases were exposed. The real risk is what comes next: scams aimed at people who are now known to own a hardware wallet.
What happened
In a statement posted on its verified X account on October 24, 2026, Keystone opened with "We owe you an apology." The timeline it gave:
- October 20: Keystone detected unauthorized access to its official website.
- October 23: after checking API activity with Shopify, the e-commerce platform its store runs on, it confirmed that a third party had obtained customers' shipping information.
- Since then: Keystone says it has blocked the access, fixed the weakness, started an investigation and begun emailing affected customers. It says a detailed report is coming.
Crypto Briefing, crypto.news and CryptoPotato all reported the disclosure. As crypto.news noted, Keystone's mention of Shopify API activity describes how the theft was confirmed. It doesn't show that Shopify itself was breached.
What was exposed, and what wasn't
Exposed, according to Keystone: each buyer's name and the address the order shipped to, their contact information, and the order itself, meaning which products they bought and what they paid.
Not exposed, according to Keystone: recovery phrases, private keys and wallet passwords, plus any payment card or bank information.
Still unknown: Keystone hasn't said how many customers were affected, which countries their orders shipped to, or who was behind it.
Why a list of addresses matters
A leak like this doesn't unlock anyone's wallet. A hardware wallet keeps its keys on the device, and Keystone says no recovery phrases or private keys were exposed. But the stolen data tells criminals exactly who bought a crypto wallet and where they live, which makes their scams far more convincing.
Keystone itself warned that fraudsters may pose as the company through calls, texts, emails or letters in the mail. The bait it listed: a refund, a replacement device, or a "fix" for a problem with your order or address. Keystone says none of those offers are real. Taylor Monahan, a security developer who goes by Tay online, also warned that hardware wallet buyers' shipping details could expose them to physical threats, crypto.news reported. Keystone's statement doesn't mention any such attacks.
This has happened before. After Ledger's 2020 customer data leak, criminals mailed altered "replacement" devices to customers to steal their recovery phrases, as our guide to buying a hardware wallet safely describes. In April 2025, crypto.news reported fake letters sent to Ledger customers that tried to get them to enter their recovery phrases.
What Keystone owners should do
- Never share or type your recovery phrase because of an email, call, text or letter. Keystone says it will never ask for it.
- Never set up a device you didn't order. Keystone specifically says not to enter your recovery phrase into one.
- Don't click links in unexpected messages, including ones that look like breach notices. Type keyst.one into your browser yourself.
- Expect fake "refund" and "order problem" messages that use your real name, address and the product you bought. Knowing your details doesn't make the sender legitimate.
- Be careful who knows you hold crypto. Don't confirm it to callers, and think twice about posting about your holdings.
Not sure about a message? Paste it into our free Scam Check first, and read our guide to impersonation scams.
The takeaway
Based on what Keystone has said, no recovery phrases, private keys or wallet passwords were exposed, so the leak doesn't give anyone access to the devices or the coins on them. The leaked addresses and order details are what scammers will use, so treat every unexpected "Keystone" message, package or phone call as fake until you've checked it through the official website. We'll update this post when Keystone publishes its detailed report. This is education, not financial advice, and it reflects Keystone's statement and news reports as of October 25, 2026.
Frequently asked questions
Is my Keystone wallet itself hacked?
Based on Keystone's October 24 statement, no. The company says the intruder took shipping and order information from its web store, and that it did not get anyone's recovery phrase, private keys or wallet password. Keystone's statement indicates this leak alone can't move your coins, as long as your recovery phrase stays private.
How do I know if my details were included?
Keystone says it is emailing affected customers. Be careful with that email, though: scammers copy breach notices too. Don't click links in it. Type keyst.one into your browser yourself, or write to Keystone's support address from its official site.
Someone sent me a new Keystone device I didn't order. What should I do?
Don't set it up and don't enter your recovery phrase into it. Keystone says it will never ask for your recovery phrase and that offers of replacement devices or refunds are not from the company. After Ledger's 2020 data leak, criminals used the stolen addresses to mail altered "replacement" devices to customers.
Should I move my crypto?
Keystone hasn't said customers need to. Its warning is about scams that use the leaked details, not about the devices. We can't give personal advice; the key rule is never to reveal or type your recovery phrase anywhere except the device you set up yourself.
Sources
- Keystone Hardware Wallet statement on unauthorized website access (October 24, 2026) (opens in a new tab) — Keystone Hardware Wallet on X
- Keystone Hardware Wallet says website breach exposed customer data (opens in a new tab) — Crypto Briefing
- Keystone wallet hack exposes buyers' home addresses, sparking security fears (opens in a new tab) — crypto.news
- Another Major Hardware Wallet Provider Suffers Data Breach as Security Concerns Mount (opens in a new tab) — CryptoPotato
- Criminals are mailing altered Ledger devices to steal cryptocurrency (opens in a new tab) — BleepingComputer
Published October 25, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.