Keystone says the web-shop intruder also took its device-authentication key and will destroy 18,835 wallets in stock

Update, 26 October 2026, 18:00 UTC: Keystone says the intruder also took the WebAuth key it uses to prove its devices are genuine, after getting in through a flaw in a third-party data monitoring tool used by its website. In a statement posted on X at 14:02 UTC, it counts 25,964 buyer records with personal data and 12,873 unpaid checkout records, and says it will destroy 18,835 wallets in stock and switch production to a new key. Recovery phrases and private keys were not involved and owners do not need to move funds because of the incident, according to Keystone; devices received after 20 October need an extra check with its support team.

Keystone, the Hong Kong-based maker of the air-gapped Keystone hardware wallet, says an intruder got into its official website and took customers’ names, contact details, shipping addresses and order details, down to the items bought and the prices paid. The company disclosed the Keystone wallet data breach in a post on X on Saturday 24 October at 17:59 UTC, and said it had confirmed the theft the day before by checking API activity with Shopify, the platform that runs its online store.

The 24 October post gave no number of affected customers and did not say how the intruder got in. Keystone’s second statement, on 26 October, gives both, and adds that a device-authentication key was taken as well. Both texts say recovery phrases, private keys and bank payment details were not exposed, and no loss of funds has been reported. The danger for buyers is a scam built on their own name and address, or a counterfeit device sold as genuine, not a wallet drained by the breach itself.

Outlets including Bitcoin.com News, Glitchwire, Coin Edition and Crypto Briefing reported the first post on 24 October; their reports repeat what Keystone said and do not confirm the breach independently. The 26 October statement, an article published on Keystone’s X account at 14:02 UTC, was covered an hour later by crypto.news and the same day by DeFiprime. Its figures are the company’s own.

Keystone’s timeline: access found on 20 October, confirmed on 23 October

“We owe you an apology,” the post begins. “On October 20, we detected unauthorized access to our official website.” On 23 October, after verifying API activity with Shopify, Keystone says it confirmed that a third party had obtained customer shipping information. Glitchwire reports that Keystone uses Shopify for its e-commerce.

Since then, by its own account, the company has blocked the access, fixed the vulnerability, opened an investigation and started emailing affected customers. “A detailed report is coming soon,” the post says, with no date attached. Coin Edition reports that a follow-up reply from the company spoke of “the coming days”. The longer account came two days later, on 26 October.

The notice lives on X, not on Keystone’s own site. When Coindaro checked on 25 October, the keyst.one homepage carried no notice about the incident and the keyst.one/blog address returned a 404 error. Bitcoin.com News published its report at 20:30 UTC on 24 October, two and a half hours after the post. The second statement also went out on X only.

What leaked from the Keystone web shop, and what Keystone says did not

The post lists four kinds of data: names, contact details, shipping addresses and order details, with items and prices. It does not spell out what “contact details” covers. Shipping records usually carry a phone number and an email address, but Keystone has not said so.

Together, that is a buyer file. Whoever holds it knows a person’s name and street, how to reach them and that they paid for a device made to store crypto. It says nothing about what is in the wallet. It does say where to send the letter or the courier.

Keystone lists what was not exposed: payment card or bank details, recovery phrases, private keys and wallet passwords. That is the company’s claim, and no outside party has checked it. It fits the design of the product. Keystone devices talk to a phone or computer through QR codes on their screens rather than USB, Bluetooth or Wi-Fi, Glitchwire notes. A breach of the store does not reach the place where transactions are signed.

Bitcoin.com News put it this way: the cryptographic defences “reportedly held”. The risk now is social engineering, meaning someone persuading an owner to hand over the recovery phrase or approve a transfer.

Keystone’s count: 25,964 buyer records still held personal data

The 26 October statement puts numbers on the leak for the first time. The intrusion touched 51,083 buyer records from purchases in the Shopify store on Keystone’s website, records that Shopify stored and managed. For 25,119 of them the personal data had already been erased before the attack, under Keystone’s retention policy, leaving only anonymised orders. The other 25,964 still held names, contact details, shipping addresses and order information, for purchases made from 2024 to 2026. Orders placed through Amazon and other sales channels were not affected, Keystone says.

A second group was not mentioned at all on 24 October: 12,873 checkout records in which a buyer typed a name, contact details and a shipping address but never paid. Keystone says some of that data may be incomplete or wrong, and that it is treating those people as affected and will warn them by email.

The age of the data comes from a failed clean-up. Keystone’s rule was to erase buyer records after 180 days. Because Shopify’s back office handles erasure one record at a time, the company built its own bulk tool, which failed on some jobs without anyone noticing. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the statement says.

Retention is now cut to 90 days. On 24 October Keystone asked Shopify to erase all buyer personal data older than 90 days and checkout data older than 30 days. Shopify imposes a 10-day wait, so the company expects the erasure to be complete on 3 November and says it will report the result. Trezor’s 2026 leak had a similar root, old order data that its logistics partner had not deleted (see below).

How the intruder got in: a third-party monitoring tool, per Keystone

On 24 October Keystone spoke only of a fixed “vulnerability” and of API activity checked with Shopify. Its 26 October statement goes further. Its security monitoring flagged unusual access on 20 October, and the attacker had exploited a vulnerability in a third-party data monitoring tool used by the website to escalate privileges. Keystone says it disabled sensitive website functions and blocked the access points the same day. It does not name the tool or say whether it was a Shopify app. Nor does it explain how a tool on the web shop led to a device key, a gap DeFiprime also points out. Coindaro found no statement from Shopify on the incident.

The length of the access is also unclear. Keystone detected it on 20 October and confirmed the data theft on 23 October, but has not said when the intruder first got in. No group has claimed the attack and no ransom demand has been reported.

Keystone’s first post did not mention a data protection regulator. The 26 October statement says reports “have already been submitted in the EU, UK, and other jurisdictions”, without naming the authorities, and Coindaro found no public notice from any of them. As a general rule under Article 33 of the EU’s General Data Protection Regulation, a company responsible for personal data must report a breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk. Article 34 adds a duty to tell the people concerned when the risk to them is high. Keystone has not said how many of the people affected live in the EU, or whether it has a representative there.

Keystone’s WebAuth key stolen: what it can and cannot do

For owners, the key is the most serious part of the new disclosure. Keystone says the attacker also obtained the WebAuth key it uses to check, through its device authentication page, whether a device is genuine. The key is written into each device at the factory and cannot be erased or rewritten. It plays no part in generating recovery phrases, deriving private keys or signing transactions, the company says.

That is why funds on a genuine Keystone are not at risk from the theft, according to the company. The danger lies further down the supply chain. “If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks,” the statement says, adding that such fakes could be sold or shipped to buyers and end in stolen assets. Coindaro found no report of a counterfeit Keystone so far.

Keystone’s answer is on the factory side. Production stops using the old key at once and new devices get a new one. The 18,835 devices in stock that carry the old key will be destroyed rather than sold. Shipping of all unshipped orders from the official website is suspended, and sales move to preorders until devices with the new key are ready; Keystone gives no date. It will not ask anyone to return a device, and says anyone requesting one under the pretext of a “recall” should be treated as a scammer.

One loose end: when Coindaro checked the authentication page on 26 October, it carried no notice of the incident, and its FAQ still said a passing result confirms that hardware and firmware are genuine. For old-key devices received after 20 October, Keystone’s own statement says a pass is no longer enough.

Keystone wallet phishing: the scams the company tells owners to expect

Phone, text, email and post are the channels Keystone names. It names the stories too: refunds, replacement devices, and “fixes” for an order or a delivery address. “None of it is from us,” Keystone writes. It says it will never ask for a recovery phrase or private key, tells owners to type keyst.one into the browser themselves rather than click links in unexpected messages, and to email [email protected] if something feels wrong.

The 26 October statement adds new scripts to watch for: calls or messages offering “asset migration”, “wallet verification” or “investigation assistance”, and the fake recall described above. Keystone tells owners not to trust them or take hasty action with their wallet.

The replacement device deserves the most suspicion. A wallet that arrives unasked can be tampered with or come with a recovery phrase already printed, which means whoever printed it holds the keys. Coindaro reported this month on tampered Ledger devices sold through a reseller, and on a fake alert sent through Ngrave’s own app that drained at least $2.56 million from about 70 wallets.

QR codes are a special case for Keystone owners, because scanning them is how the wallet works. The only codes that belong in that routine are the ones shown by their own device and their own companion app, never one printed on a letter or sent in a message.

Ledger 2020, Trezor 2024 and 2026: hardware wallet data breaches follow buyers for years

Keystone is the latest hardware-wallet maker to lose its customer list, and the earlier cases show how long such data stays in use. The closest parallel is Ledger, the French maker, whose own account is set out in a post dated 13 January 2021.

On 14 July 2020 a researcher told Ledger, through its bounty programme, that its e-commerce and marketing database had been reached with a third party’s API key. Ledger closed the hole the same day, told the French data protection authority, the CNIL, on 17 July and emailed customers on 29 July. That first breach covered more than one million email addresses and about 9,500 detailed records with name, address, phone number and products ordered.

On 20 December 2020 the full databases appeared on a forum: about 272,000 records with names, postal addresses and phone numbers, plus the million-plus emails. On 23 December Shopify told Ledger about a separate incident, in which one or more rogue members of Shopify’s support team had exported merchants’ customer records in April and June 2020. About 292,000 Ledger customers were in that export. Ledger says the set was 93% similar to the data already exposed and held about 20,000 new records. By January 2021 it had had 216 phishing sites shut down, and it said the FBI and Canada’s RCMP were investigating.

Ledger’s 2020 case and Keystone’s 2026 one share two features: a Shopify-run store and stolen shipping data.

Trezor followed in January 2024. Its maker said a third-party support ticketing portal had been accessed without authorisation, exposing the names or usernames and email addresses of about 66,000 users, according to BleepingComputer, which reported that the data was later used in phishing attempts aimed at wallet recovery seeds. Postal addresses were not part of that set.

In 2026 Trezor was hit through its logistics partner, ShipMonk. BleepingComputer reported on 7 September that the first disclosure, on 13 August, covered nearly 14,000 customers in Brazil, Colombia, Italy, Portugal, Sweden and the UK who ordered between 10 May and 8 August 2026. An update added 67,000 US customers whose orders date from November 2019 to August 2021, for a total of 81,000. Trezor says ShipMonk had not deleted that older data despite written assurances. Notification emails seen by BleepingComputer blame a vulnerability in the Metabase analytics tool; ShipMonk has not explained how it was breached.

Leaked addresses may also explain the letters. Decrypt reported on 17 February 2026 that owners were receiving printed letters with Trezor or Ledger branding and holograms, asking them to scan a QR code for a mandatory “Authentication Check” or “Transaction Check”. Cybersecurity researcher Dmitry Smilyanets posted a Trezor-branded letter with a US postmark on X on 12 February; Ledger-themed ones had circulated since October 2025. Decrypt says the senders are likely drawing on years of leaked customer data, a link nobody has proven. No such letter has been reported by Keystone buyers so far.

Coldcard owners, for their part, have gone to court: see our report on the Toronto class action against Coinkite.

Is my Keystone wallet safe? What owners can do now

Owners do not need to move their assets “solely because of this incident”, Keystone says, since recovery phrases and private keys were not part of it. That holds as long as the recovery phrase has never left the device and its paper or metal backup, and as long as the device is genuine. What to do first depends on when the wallet arrived.

• Delivered before 20 October 2026: Keystone says its authentication is unaffected. Run the check on keyst.one/authentication/; if the device passes, it can be used normally.
• Received after 20 October with the old key: even if it passes the online check, do not set it up or move funds onto it yet. Follow the authentication page’s instructions to contact support for an extra verification, and use the device only once Keystone has confirmed it is genuine. Keystone does not say how an owner can tell which key a device carries, or what the extra check involves.
• If the check fails, stop using the device, never enter a recovery phrase into it, keep a screenshot of the result and write to [email protected], as the authentication page advises.
• Do not post your device to anyone. Keystone says it is not recalling wallets.
• An unshipped order from keyst.one stays on hold until devices with the new key are made; Keystone has given no shipping date.

The other steps are about not being talked into giving the phrase away.

• Read Keystone’s notification email if you get one, but reach the company only by typing keyst.one or writing to [email protected], not through links or numbers in a message.
• Treat any refund, replacement offer or “order problem” that reaches you by phone, text, email or post as hostile until Keystone confirms it through those channels.
• Refuse a device you did not order. Keystone’s post says never to enter your recovery phrase into one, and a wallet that arrives with a phrase already written down belongs in the bin.
• Never type, photograph or read out your recovery phrase, whoever asks. Keystone says it never will.
• Scan only the QR codes shown by your own Keystone and its companion app, never one printed on a letter or sent by message.
• If you have already entered your phrase on a website or given it to a caller, set up a new wallet with a new phrase and move the funds there.

Our guide on storing a recovery phrase safely covers backups and what to do if one is exposed, and our guide to avoiding crypto scams lists the common scripts and where to report them. Expect the attempts to last: Ledger’s 2020 data was still feeding phishing months later, and the letters reported in 2026 reached owners of both Ledger and Trezor devices.

Next: data erasure due on 3 November, no date for new devices

The detailed report Keystone promised on 24 October came two days later, and it leaves several steps for later. The Shopify erasure should be complete on 3 November, and Keystone says it will confirm the result. A page where buyers can check whether their data was exposed, and another showing whether it has been erased, are promised without a date, as are individual emails, a security audit and the restart of shipping.

Still unknown: the name of the monitoring tool, how it led to the device key, which models or batches carry the old key, how many of those devices reached buyers after 20 October and what the extra verification involves. The public record now holds four dates: access detected on 20 October, theft confirmed on 23 October, first disclosure on 24 October, full statement on 26 October.