Keystone Hardware Wallet Faces Shipping Data Breach
A third party accessed customer shipping information through the company's website last week.
Updated on Oct. 25, 2026 in Cybersecurity
Live Poll
Do you trust hardware wallet providers to keep your personal shipping data secure?
Keystone, a provider of hardware cryptocurrency wallets, confirmed that a third party accessed customer shipping information through its official website. The breach compromised names, contact details, shipping addresses, and specific order information.
Why it matters
The incident highlights ongoing security risks for hardware wallet users, as exposed shipping data can be used by attackers to launch targeted phishing campaigns against cryptocurrency holders. While core security assets remain unaffected, the exposure of physical addresses presents a distinct privacy and safety risk for customers.
Keystone confirmed that the unauthorized access occurred through its API activity via the Shopify platform. Although customer shipping data was obtained, the company verified that recovery phrases, private keys, passwords, and payment card details were not exposed.
The players
Keystone
Keystone is a hardware wallet manufacturer that provides security solutions for users to store cryptocurrency assets offline.
Shopify
Shopify is a global e-commerce platform that provides the infrastructure and API services used by various businesses to manage their online storefronts.
The details
The unauthorized access was first detected on the Keystone website, leading to the confirmation of data theft three days later. Keystone has since blocked the intrusion and patched the vulnerability that allowed the third party to access its systems.
Timeline
Unauthorized access was detected on the Keystone website on October 20, 2026.
The theft of customer shipping information was officially confirmed on October 23, 2026.
The Tech Race
This incident exposes a structural vulnerability in the hardware crypto wallet ecosystem, where even high-security devices rely on third-party web platforms like Shopify. It illustrates the ongoing arms race between companies prioritizing offline security and attackers exploiting e-commerce infrastructure to bridge the gap.
Customers who have purchased products from the Keystone website should remain vigilant against suspicious emails or text messages requesting personal information or claiming to be from the company. The breach does not impact the security of existing private keys or recovery phrases stored on hardware devices, meaning physical wallet access remains safe.
The takeaway
Users should treat any communication referencing their purchase history with extreme caution following this data exposure. As a defensive measure, enabling multi-factor authentication on all associated email and crypto-exchange accounts is recommended to mitigate potential phishing attempts.
Further reading
Learn more about securing your digital assets in the Cybersecurity section.
Live Poll
Do you trust hardware wallet providers to keep your personal shipping data secure?
