Key takeaways
- Keystone says a third party obtained buyers' names, contact details, shipping addresses and order details from its website.
- Keystone says recovery phrases, private keys, wallet passwords and payment card details were not exposed in the breach.
- Some Keystone customers say they got notices despite a pledge to delete shipping data 180 days after each order.
Hardware wallet maker Keystone said a third party obtained customer shipping information after unauthorized access to its official website, and the exposed data included customer names, contact details, shipping addresses and order details such as items and prices. Keystone said it confirmed the breach after verifying application programming interface (API) activity with Shopify, which powers its online store.
Keystone said payment card or bank details, recovery phrases, private keys and wallet passwords were not exposed. It said it blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers, but Keystone has not said how many customers were affected or how the attacker got in.
From Shipping Labels to Wrench Attacks
Keystone warned the leaked data could be used for targeted phishing, and security researcher Taylor Monahan raised concerns about physical attacks and kidnappings. Blockchain security firm CertiK recorded 52 verified wrench attacks, physical coercion attacks on holders, in the first half of 2026, up 33% from 39.
Keystone also warned that scammers may pose as the company by phone, text, email or mail. It told users never to enter a recovery phrase into a device they did not order, not to click links in unexpected messages and to type the company's web address themselves.
A Deletion Promise Under Question
Keystone's Privacy Promise page says "all shipping information is automatically deleted 180 days after your order is placed." Several customers on X said they were notified or affected despite orders older than 180 days, and one said the order was placed over two years ago.
Those customer claims have not been verified, and Keystone has not publicly responded to them. Keystone has promised a detailed report on the breach in the coming days.
Our advice is to assume your name, address and contact details are in criminal hands. Treat any inbound call, text, email or parcel claiming to be Keystone, a courier or law enforcement as hostile, rotate passwords, turn on two-factor authentication and use a delivery alias for future hardware orders.
Why It Matters
A third party obtained customer shipping information from Keystone's website, while recovery phrases and private keys were not exposed, so self-custody held exactly where it was designed to hold. The weak point was a merchant database that tied buyers' names and shipping addresses to a hardware wallet order, plus a 180-day deletion promise that some customers now doubt. We think every company selling Bitcoin custody gear should treat customer records as a liability to delete, not an asset to keep, because a leaked address turns your keys into a physical target for wrench attacks. Pay with sats, ship to an alias and hand merchants as little as possible, since data that is never collected can never be leaked or used for surveillance.
