Keystone says website breach exposed customer names and addresses

Keystone, a maker of hardware wallets for storing crypto offline, said a breach of its website exposed customer names, shipping addresses and order details. The company confirmed the theft on October 23 and told customers their recovery phrases and private keys were not touched.

The disclosure came in a statement the company posted to its verified account on X on October 24. "We owe you an apology," Keystone wrote, saying customers had trusted it with those details. Two separate reports, by CryptoBriefing and crypto.news, quoted the same statement.

What leaked, and what did not

Keystone's list of exposed data covers names, contact details, shipping addresses and order information, such as the items bought and the prices paid. That is enough to link a real person to a home address, and to the fact that they own a device built to hold crypto.

Payment card numbers, bank details, recovery phrases, private keys and wallet passwords were not taken, the company said. Those secrets control the coins. A hardware wallet keeps them offline, on the device itself. No keys leaked. A breach of a sales database does not hand an attacker the funds.

How the breach happened

Keystone's own account is short on detail but clear on dates. It spotted unauthorized access to its website on October 20. Three days later, after reviewing API activity with Shopify, the platform that runs its online store, it confirmed that a third party had pulled customer shipping records.

Checking Shopify's records to confirm the theft does not mean Shopify itself was breached. Connected apps and tools can read store data depending on the permissions a merchant grants them, and Keystone has not said which account, app or credential was involved.

What the company has not said is how the attacker got in. It has not named a stolen credential, a faulty app or any other weakness. Keystone also has not said how many customers were hit, where they are, or when the access began. A fuller report is promised in the coming days.

Why a leaked address is worth worrying about

A hardware wallet exists so people can hold crypto themselves, off an exchange and out of a company's custody. The breach does not break that setup. It does something else. It hands scammers a vetted list of owners, with real addresses, known to hold enough crypto to buy a dedicated device to protect it.

That opens two lines of attack. The first is phishing. Keystone warned that scammers may pose as the company by email, phone, text or even physical mail, offering fake refunds, replacement devices or help fixing a delivery. Its advice was blunt: never share a recovery phrase or private key, and never type one into a device that did not arrive as part of a confirmed order.

A second risk is physical. Taylor Monahan, a security researcher, warned that leaked home addresses tied to crypto ownership can invite robbery or worse, the kind of in-person attack where a thief forces a victim to hand over funds. Keystone's disclosure points to no such case so far. The worry is the pattern.

Crypto owners have seen a version of this before. When Ledger, a rival wallet maker, lost customer data in 2020, roughly 272,000 records later circulated online, and buyers reported phishing emails, fake apps and even physical threats. A separate Ledger case this year involved a tampered device sold through one reseller. In both, the hardware and the private keys held. The exposed people were the problem.

What to watch

Keystone has promised a detailed report, which should set out how the attacker got in and how many people were exposed. Until it lands, the open question is the size of the leak. Anyone who bought a Keystone device and gave a home address should assume their contact details are now circulating, and should be slow to trust any message that leans on that knowledge.