If you ever ordered from Keystone's online store, assume your name, contact details, shipping address and order history were stolen. Keystone confirmed on October 23, 2026 that a third party took customer shipping data from its Shopify store. Recovery phrases, private keys and payment cards were not exposed, so the main risks are targeted phishing and physical-security threats.
What Happened in the Keystone Breach
Keystone is a Hong Kong-based maker of air-gapped hardware wallets that sign transactions by QR code. The company disclosed the incident on X on October 24, 2026 and apologized to customers. Here is the timeline it gave:
- October 20, 2026: Keystone detected unauthorized access to its official website
- October 23: after reviewing API activity with its store provider Shopify, Keystone confirmed a third party had obtained customer shipping information
- October 24: public disclosure; Keystone said it had blocked the access, patched the vulnerability and begun emailing affected customers
Keystone has not said how many customers were affected, how the attacker got in, or who was behind it, and has promised a fuller report. Some customers say they received breach notices for devices bought more than two years ago, which suggests old order records were included. This is the second hardware wallet supply-chain leak this year after the Trezor / ShipMonk breach in August.
What Data Was Exposed
- Customer names
- Contact details (email address and phone number)
- Shipping addresses
- Order details, including the items purchased and the prices paid
Keystone says payment card and bank details, recovery phrases, private keys and wallet passwords were not compromised. Your crypto is not directly at risk from this leak, because the wallet itself never touched the store.
Why a Shipping-Address Leak Is Serious for Crypto Owners
The stolen list is effectively a directory of people who own crypto, with their home addresses and what they paid. That fuels two threats: convincing phishing that uses your real order details, and "wrench attacks," where criminals show up in person to force victims to unlock their wallets. Security researchers flagged that physical risk within hours of the disclosure.
Step 1: Never Enter Your Recovery Phrase Anywhere
Keystone warned that scammers may pose as its staff and offer refunds, replacement devices, or help changing an order or shipping address. No legitimate company will ever ask for your recovery phrase. Do not type it into a website, app or form, and never enter it into a device you did not order yourself — tampered "replacement" wallets that arrive in the mail are a known scam, and Ledger confirmed this month that criminals had tampered with genuine devices to steal recovery phrases.
Step 2: Treat Every "Keystone" Message as Suspicious
Expect emails, texts, phone calls and even letters that quote your real order. Check any claim by signing in through Keystone's official site or channels you find yourself, not through a link or number in the message. Be especially wary of anyone who asks you to call them back; callback phishing is a favorite tactic after retail breaches.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 3: Lock Down Your Phone Number and Accounts
Attackers who know your phone number may try a SIM swap to intercept login codes. Add a port-out PIN or number lock with your mobile carrier, move exchange and email accounts to an authenticator app or hardware security key instead of SMS codes, and enable withdrawal allowlists on any exchange that offers them.
Step 4: Consider Moving Funds If You Reused Anything
If you ever typed your recovery phrase into a computer, photographed it, or stored it in a cloud note, treat it as compromised regardless of this breach and move your funds to a newly generated wallet. If you think a wallet has already been drained, follow our guide on what to do if your crypto wallet is hacked.
Step 5: Make Your Home Address Harder to Find
The leaked shipping addresses are a fixed fact, but criminals use people-search sites and data brokers to confirm addresses, find relatives, and learn your routine. Removing those listings makes the stolen data harder to act on and stops new addresses from being linked to you if you move. Start with our guide to hiding your home address online, and for future hardware purchases consider a PO box, a parcel locker, or a shipping address that is not your home.
How PrivacyOn Helps Crypto Holders
PrivacyOn removes your name, home address, phone number and relatives from 100+ data broker and people-search sites, then monitors 24/7 and re-files when listings reappear. Dark web monitoring alerts you if your email or phone number shows up in a new leak. Plans start at $8.33/month and cover up to 5 family members. See how it compares in our best data removal services ranking.
Frequently Asked Questions
Was my crypto stolen in the Keystone breach?
No. Keystone says recovery phrases, private keys and wallet passwords were not compromised, and the breach affected its online store rather than the wallets. Your funds stay safe as long as you never enter your recovery phrase into a website, app or device sent to you by a "support agent."
What data was leaked in the Keystone wallet breach?
Customer names, contact details, shipping addresses and order details, including the products bought and prices paid. Keystone says payment card and bank details were not affected.
How many Keystone customers were affected?
Keystone has not published a number. It is emailing affected customers directly, and some customers report receiving notices for orders placed more than two years ago, so anyone who has ever bought from the Keystone store should assume they are included.
Will Keystone send me a replacement wallet?
Treat any unexpected replacement-device offer as a scam. Keystone specifically warned that criminals may pose as its staff offering refunds or new devices. Never use a wallet you did not order yourself, and never type your recovery phrase into one.
How do I protect my home address after the Keystone leak?
You cannot recall leaked shipping data, but you can stop criminals from confirming and expanding it. Remove your listings from people-search sites, use a PO box for future crypto purchases, and avoid posting about your holdings. PrivacyOn automates this by removing your address from 100+ data broker sites and re-checking 24/7, from $8.33/month.