Keystone, the Hong Kong-based hardware wallet maker, disclosed on Friday that an unauthorized party had accessed its website and obtained customer shipping records. The breach exposed names, contact information, physical addresses, and order details including which products customers bought and at what price. Payment card numbers, bank details, recovery phrases, and private keys were not among the stolen data, according to the company.
The company said it detected suspicious activity on October 20 and confirmed three days later, after reviewing API logs with Shopify, that a third party had obtained the records. Keystone uses Shopify for its e-commerce operations.
In a statement posted to X, the company apologized to affected customers. "You trusted us with those details, and we're sorry we didn't keep them safe," the post read. Keystone said it had blocked the access vector, patched the underlying vulnerability, and begun notifying customers by email. A more detailed report is promised in the coming days.
Physical addresses are the point
Hardware wallets exist to keep cryptographic secrets offline. Keystone's devices communicate via QR codes rather than USB, Bluetooth, or Wi-Fi, a design choice meant to eliminate any radio-based attack surface. The breach had nothing to do with that security model. It concerned the web storefront and its connection to order fulfillment.
Still, customer records matter. A scammer who knows someone's name, home address, and the fact that they bought a hardware wallet has the raw material for targeted impersonation. Keystone warned customers to expect phishing attempts by phone, text, email, or even physical mail, with attackers posing as company representatives offering refunds, replacement devices, or help with shipping problems.
"We will never ask for them," the company said of recovery phrases and private keys. It urged customers not to enter their recovery phrase into any device they did not personally order.
A year of hardware wallet failures
The Keystone incident arrives after a particularly damaging stretch for the hardware wallet industry. In August, Trezor disclosed that a breach at its logistics provider ShipMonk had exposed personal information for nearly 14,000 customers. That figure later expanded to approximately 81,000 after further investigation. The attack exploited a SQL injection vulnerability in Metabase, an analytics platform used by ShipMonk. Some of those affected have since reported receiving postal letters with malicious QR codes urging them to "migrate" their wallets to phishing sites.
Ledger faced a different and more alarming problem. In October, the Paris-based company confirmed that criminals had modified genuine Ledger devices with spy-chip implants designed to intercept recovery phrases as users initialized their wallets. The tampered devices, sold at a discount through Southeast Asian reseller CryptoBilis, transmitted captured phrases over LTE. On-chain researchers estimate losses exceeding $90 million across roughly 300 wallets, though Ledger has not confirmed that figure.
Ledger said its own manufacturing and firmware were not compromised and that the Secure Element chips in affected devices still passed the company's Genuine Check. The implant worked by intercepting data sent to the screen, not by altering the cryptographic core. The company has suspended sales through CryptoBilis and introduced new retailer requirements that prohibit reselling returned units.
What Keystone customers should do
Keystone advised customers to type keyst.one directly into their browser rather than clicking links in unexpected messages. Anyone who receives communications claiming to be from the company should verify them through official support channels before taking action. The company's support email is [email protected].
The exposed data did not include anything that could compromise wallets directly. But the list of people known to own hardware wallets, matched to their home addresses, now sits with whoever accessed the database. For a product category built on the premise that trust can be minimized, that exposure is its own kind of breach.
Keystone has not disclosed how many customers were affected. The company plans to release a detailed incident report, though no date has been given.
