A website intrusion at hardware wallet maker Keystone gave a third party shipping and order information drawn from 25,964 Shopify purchase records and 12,873 incomplete checkout records, along with device authenticity keys. Detection came on 20 October 2026, confirmation of the exposure followed on 23 October 2026 after Shopify API activity was reviewed, and disclosure on X followed on 24 October 2026. Findings reported on 26 October 2026 covered the attack route, the effect on devices, and a retention failure under which order data remained in place beyond its promised deletion date.
Chronology of detection and disclosure
Unauthorised access to the official website came to Keystone's attention on 20 October 2026. Verification of API activity with Shopify led the company on 23 October 2026 to confirm that customer shipping information had reached a third party. A statement published on X on 24 October 2026 apologised, recorded that access had been blocked, the vulnerability fixed, and an investigation opened, and noted that emails to affected customers had begun. ProCoinNews quotes the 24 October statement, with matching dates and a matching order of detection, confirmation, and disclosure. TradingView, carrying Cointelegraph's report, matches that timeline and that account of the disclosure. Findings reported on 26 October added the attack route, through a vulnerability in a third-party data monitoring tool, and the WebAuth key impact.
Records and data fields exposed
Crypto.news puts the investigation's count for the official Shopify store at 51,083 purchase records, of which personal information had already been erased from 25,119, so 25,964 remained holding customer details from purchases between 2024 and 2026, according to Crypto.news. Personal information submitted by customers who stopped before payment sat in a further 12,873 incomplete checkout records. The totals count records, not a confirmed number of unique people, and one individual may show up in more than one record category. The sources read for this article contain no count of unique people.
Names, contact details, shipping addresses, and order details, including items and prices, form the field list in Keystone's own statement. Cointelegraph's report, carried by TradingView, carries the identical list and adds Keystone's warning about possible use of the information in targeted phishing attacks.
The phrase in Keystone's own statement is "contact details", with no separate item for email addresses. Iboro Finance gives the exposed data as full names, email addresses, phone numbers, physical shipping addresses, and purchased items. Blockonomi gives the same set, as customer names, emails, phone numbers, shipping addresses, products, and prices. Email addresses are therefore credited here to that secondary reporting, and not to Keystone's own wording. ProCoinNews cites Keystone's shipping-data policy, which lists email addresses among details covered by deletion, yet policy scope of that kind is not a statement that emails were exposed in this incident.
Mnemonics, private keys, and payment information were not compromised, Keystone stated.
Wallet credentials, banking information, and government identification numbers join the not-compromised list in Crypto.news reporting. One order record therefore ties together a real person, a home address, and a crypto security product, while the company description of the exposure leaves wallet contents outside it.
Device authenticity keys
Manufacturing embeds the WebAuth key into Keystone hardware wallets, and customers use it when checking devices on the company's authentication website. Once installed, the key cannot be erased or rewritten, Crypto.news reports, and it plays no part in generating recovery phrases, deriving private keys, or signing transactions. Possession of the key could potentially let an attacker manufacture counterfeit devices able to pass Keystone's official authenticity checks, so the device response includes destroying inventory devices and pausing orders.
Production using the old keys has ceased, and 18,835 devices in inventory using the old keys will be destroyed, according to KuCoin and Crypto.news. The official website has paused unfulfilled orders, with sales on a pre-order model until replacement devices are ready. Normal use continues for devices received and verified before 20 October 2026. Further verification through customer service applies to old-key devices received after 20 October 2026, even where they pass verification, with no return required by Keystone. Keystone also warned that a person requesting a device on the pretext of an official recall should be treated as a scammer.
Retention failure and deletion requests
Deletion after 180 days was the rule for Keystone's data, yet an automated deletion tool failed and some records stayed longer. The 180-day rule, the tool failure, and the shortened 90-day retention period are reported by KuCoin. Crypto.news reports Keystone's acknowledgement that failed deletion requests went undetected in time, so information stayed stored longer than permitted. Company confirmation, not an attacker claim, stands behind the failure, and the failure explains the continued presence of records from purchases between 2024 and 2026.
Customers had already raised the retention question before the 26 October findings. Some customers said they received breach notifications despite buying devices more than two years earlier, TradingView and Cointelegraph report, and Keystone had cut its retention period to 180 days in a 2023 blog post after security incidents at other hardware wallet makers. Individual claims quoted in reporting, not confirmed cases, describe those customer reports, while the 26 October findings confirm the underlying mechanism, the failed automated deletion tool.
The breach total must not be confused with a separate comparison figure. Full implementation of the 90-day period would have meant 2,233 exposed records, Keystone said in an X exchange on 26 October, as reported by CryptoTimes, against 3,576 under the 180-day period. That comparison alone is what those figures describe, and they stand apart from the 25,964 purchase records in the broader disclosure. Direct opening of the CryptoTimes page proved impossible during preparation of this article because it returned a bot check, so the outlet's search-result text underpins the comparison figures and the deletion timeline attributed to CryptoTimes, which appear here as reported figures rather than directly verified text. Keystone asked Shopify on 24 October to delete overdue data, and buyer data beyond the 90-day threshold is expected to reach final deletion on 3 November 2026 after Shopify's 10-day waiting period. Incomplete checkout information retained longer than 30 days falls under separate requests.
Company response and regulatory reports
Blocking of the unauthorised access, fixing of the vulnerability, and opening of a forensic investigation followed detection, Crypto.news reports, with sensitive website functions disabled after detection on 20 October. Email notification of affected customers and lookup pages for checking whether information was affected and whether it has been deleted are promised by the company. A separate later service to confirm erasure is also reported by Crypto.news. Regulatory and law enforcement reports already submitted in the European Union, the United Kingdom, and other jurisdictions, with more planned where required, appear in Crypto.news reporting alone, and the regulatory claim is attributed here to Crypto.news only. The 24 October statement promised a detailed report, which had not appeared in the sources read for this article.
Leaked shipping information creates a risk of physical attacks, not only phishing, security researcher Taylor Monahan warned, as reported by TradingView, carrying Cointelegraph's report. Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, TradingView cites, up 33 percent from 39 in the same period last year. Physical threats to force cryptocurrency holders to surrender assets define wrench attacks. Attributed reporting, not a claim by Keystone, provides that context, and it is not a confirmed outcome for any Keystone customer. The sources read confirm no misuse of the copied Keystone data beyond user-reported scam contact.
Measures for affected buyers
Keystone described measures for affected buyers in its statement and in published guidance. Scammers posing as Keystone by phone, text, email, or mail may offer refunds, replacement devices, or fixes for an order or address, Keystone warned, and none of those offers come from the company. Customers were advised never to share a recovery phrase or private key, never to enter a recovery phrase into a device that was not ordered, and not to click links in unexpected messages. A breach notice recipient can use Keystone's planned lookup pages and reach Keystone through its official website, typed directly into a browser, instead of through a link in a message. Known breach data can also be checked for an email address through guides such as how to check if your email was leaked, and targeted-scam use of leaked order details can be read about in how phishing uses a leaked email.
Inbox advice alone does not cover the measure added by the physical address element. Long after a phishing email goes stale, a home address tied to a hardware wallet purchase stays useful to an attacker. No claim is made here that any Keystone customer has suffered a physical attack as a result of this breach.
AliasFleet and checkout addresses
Each website gets a separate email alias from AliasFleet, so an address given to one store differs from the address used for every other service. Later exposure of that store's records leaves the exposed address identifying only that store, and pausing or deleting the alias leaves the address used elsewhere unchanged. A shipping address, a phone number, or an order record stays in a store's own systems despite AliasFleet, and neither a device authenticity key nor a recovery phrase gains protection from it. Plainly stated, the product limit is this: an alias controls the email address a store holds, not the other fields in the store's order record. The mechanism and its limits appear in a different email for every website for readers who use one address across stores. A bank account differs: a bank keeps a permanent real dedicated address, never an alias, because recovery, statements, and fraud alerts depend on it, while aliases serve other services.
Sources and reporting limits
Keystone's announcements, as reported by KuCoin, Crypto.news, ProCoinNews, TradingView with Cointelegraph, Iboro Finance, Blockonomi, and CryptoTimes search text, underpin this article. Keystone's notice is an X statement with no standalone notice page or screenshot in the sources read, so no screenshot is embedded in this article. The sources read contain no unique-person victim count, establish no confirmed misuse of the copied data beyond user-reported scam contact, and show no publication of Keystone's promised detailed report. Keystone's planned lookup pages, not live in the sources read, will decide whether any specific customer's record was affected, or has been deleted. The Foundation hardware-wallet phishing incident of 25 to 26 October and the Ledger reseller story are separate incidents, and neither is attributed to Keystone here. CryptoCompass carries the same email itemisation as Blockonomi in its summary of the incident.
Top comments (0)