Keystone Acknowledges Data Breach but Denies Key Compromise

The hardware crypto wallet manufacturer Keystone confirmed that an attacker gained access to the company's online store and stole customers' personal data. According to the firm's statement, the hacker obtained clients' names, contact information, shipping addresses, details about ordered devices, and their costs. Unauthorized access to the site was discovered on October 20. Three days later, the company, together with Shopify, on whose platform the store operates, checked the activity in the API and confirmed the leak. After that, the developers blocked access, fixed the vulnerability, started an internal investigation, and began sending notifications to the affected customers via email.

Keystone claims that payment and banking details, seed phrases, private keys, and wallet passwords were not affected. However, there is no independent confirmation of these claims yet. The company has not disclosed the number of affected individuals, the method of system penetration, or the identity of the attacker. A detailed report is promised to be published in the coming days.

Following the incident, some customers doubted that Keystone adhered to its own privacy policies. The manufacturer's website states that delivery information is automatically deleted 180 days after the order is placed, and customers can request deletion immediately after receiving the device. The company has repeatedly emphasized this as an advantage. However, several users reported on X that they received notifications about the leak even though more than 180 days had passed since their order. A client with the nickname trintaetres_33 mentioned that he purchased a wallet more than two years ago. Another user noted that 214 days had passed between his last order and the breach.

Another customer under the pseudonym PEPE_Whale69 raised the alarm before the manufacturer's official statement. According to him, he received a call from a spoofed Montreal police number asking if he was familiar with the names Amazon, eBay, or Keystone. The caller had information that matched PEPE_Whale69's order data from Keystone in 2024. In response, the company stated that it had launched an urgent investigation but did not publicly address the question about the 180-day rule. Meanwhile, in the current privacy policy, updated on July 7, 2026, the period is counted not from the order date but from the last purchase. According to the document, the company deletes data only for those clients who have not ordered anything for 180 days. If a customer places a new order, information about previous ones is retained. The same clause is present in the help center article, last updated in February 2023.

Recall that in August, the hardware wallet manufacturer Trezor reported a data leak of nearly 14,000 customers following a breach of the logistics partner ShipMonk. In September, the company reported another 67,000 affected, bringing the total number of users impacted by the incident to nearly 81,000. The compromised database contained names, phone numbers, email addresses, and shipping addresses.