Keystone Wallet Says Website Breach Exposed Customer Addresses

Hardware wallet maker Keystone said Saturday that an Oct. 20 breach of its website let a third party take customer names, contact details, addresses and order details.

In a post on X, the company said it detected unauthorized access on Oct. 20. It confirmed on Oct. 23, after checking API activity with Shopify, that customer data had been taken. "You trusted us with those details, and we're sorry we didn't keep them safe," Keystone wrote.

The company said payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed. It said it had blocked access, fixed the flaw, opened an investigation and started emailing affected customers. The Defiant also reported the breach.

The real risk is the mailbox

A leaked address list tells scammers who owns a crypto wallet and where they live. Keystone warned that fraudsters may pose as the company by phone, text, email or mail, offering refunds, replacement devices or fixes for an order. It said it will never ask for a recovery phrase and that customers should never enter one into a device they didn't order.

Some customers said on X that they had already received suspicious calls before the disclosure. Keystone has not said how many customers were affected or how far back the exposed orders go. In replies on X, it said a detailed report would follow next week.

Keystone told customers with doubts to email its support team directly rather than trust incoming messages.