Keystone Hardware Wallet, a maker of air-gapped devices designed for self-custody of cryptocurrencies, publicly disclosed on October 24, 2026, that an unauthorized party accessed its official website and obtained certain customer information.
The company stated that it first noticed the intrusion on October 20 and, after coordinating with Shopify to review API activity, confirmed three days later that a third party had retrieved shipping-related records.
According to the firm’s announcement, the data that was accessed includes customer names, contact information, shipping addresses, and order specifics such as the products purchased and the prices paid.
Keystone emphasized that more sensitive elements remained untouched: payment card and bank details, recovery phrases, private keys, and wallet passwords were not part of the exposed material.
The company expressed regret for the incident, noting that customers had entrusted it with the affected personal details.
In response, Keystone reported that it had terminated the unauthorized access, addressed the underlying vulnerability, launched an internal investigation, and begun notifying impacted customers by email.
It indicated that a more complete incident report would be published in the near term and that a thorough review remains underway.
No information has been released publicly about the identity of the actor involved, the precise number of people affected, the length of time the access persisted, or the specific technical method used beyond the Shopify API verification.
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…
— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026
The hardware wallet maker also cautioned users about follow-on risks.
Scammers could leverage the leaked shipping and order data to impersonate Keystone via phone calls, text messages, email, or physical mail, offering refunds, replacement devices, or purported help resolving order or address problems.
None of these outreach efforts would originate from the company, Keystone stated.
It advised customers never to share recovery phrases or private keys under any circumstances, never to enter a recovery phrase into a device they did not personally order, and to avoid clicking links in unexpected communications.
Users were told to navigate to the official site by manually typing the address rather than following links, and to contact support@keyst.one if anything appears suspicious.
The company reiterated that it will never request recovery phrases or private keys.
Hardware wallets such as those produced by Keystone are engineered so that private keys never leave the device and are typically used in an air-gapped manner, with transaction data exchanged via QR codes rather than direct internet connections.
The firm’s statement distinguishes the website incident from any compromise of the devices themselves or of the cryptographic material needed to control funds.
The exposure is limited to commercial and shipping records associated with orders placed through the site.
The disclosure arrives amid a broader pattern of security events affecting hardware wallet vendors and related services, underscoring the persistent targeting of customer data held in e-commerce systems even when the core wallet technology remains isolated. Keystone has directed affected individuals to rely exclusively on its verified channels while the investigation continues and the promised detailed report is prepared.
