SKN | Keystone Data Breach Exposes Hardware Wallet Buyers’ Shipping Addresses

Key Points

• Hardware wallet manufacturer Keystone confirmed that an unauthorized third party accessed customer names, contact details, shipping addresses and order information through a website vulnerability.
• The exposed information could enable targeted phishing attempts and potentially increase the risk of physical attacks against cryptocurrency holders.
• Customers who purchased devices more than two years ago reportedly received breach notifications, raising questions about Keystone’s stated 180-day shipping data retention policy.

Keystone Confirms Website Security Breach

Cryptocurrency hardware wallet manufacturer Keystone has disclosed a website security breach that exposed customer information, raising concerns about targeted fraud and the physical security of digital asset holders.

In a statement published Saturday on X, the company said it detected suspicious activity earlier in the week. Following a review of API activity with Shopify, Keystone confirmed on Friday that an unauthorized third party had accessed customer shipping information.

The exposed data included names, contact details, shipping addresses and order information, including the products customers purchased.

Keystone said it had blocked unauthorized access, fixed the vulnerability, launched an investigation and begun notifying affected customers by email. The company apologized for the incident but did not disclose how many customers were affected.

The breach highlights a security risk associated with hardware wallet purchases: customer records can reveal not only personal information but also a potential connection to cryptocurrency storage products.

Phishing and Physical Security Concerns

Keystone warned that the exposed information could be used in targeted phishing attacks. Security researcher Taylor Monahan also raised concerns that the disclosure of shipping addresses could expose cryptocurrency holders to physical threats, including kidnapping and coercion.

Such attacks, often referred to as “wrench attacks,” involve using threats or physical violence to force victims to surrender cryptocurrency or provide access to their assets.

Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide during the first half of 2026, a 33% increase from 39 incidents during the same period in 2025.

The exposed shipping information does not establish that customers have been targeted physically. However, linking a person’s identity and home address to a hardware wallet purchase could give malicious actors information that may be useful in selecting targets or constructing convincing scams.

One X user, posting under the name “OG DEGEN,” reported receiving a telephone call from someone claiming to be law enforcement investigating a fraud case. The user suspected the caller had obtained personal information through a Keystone order placed in 2024.

The user said the caller’s approach appeared consistent with an attempt to convince them that their private keys had been exposed before directing them to a fraudulent link. This account remains an individual report and does not independently establish that the call originated from the Keystone breach.

Questions Over the 180-Day Data Retention Policy

The incident has also raised questions about Keystone’s handling of historical customer records.

In a 2023 blog post, the company said it had reduced its customer shipping data retention period to 180 days following security incidents involving other hardware wallet manufacturers.

However, some customers reported receiving breach notifications despite purchasing their devices more than two years earlier. One X user, trintaetres, said they received a notification despite buying their hardware wallet over two years ago.

These reports have prompted questions about whether older order records remained in Keystone’s systems and whether the company’s retention policy was implemented as described.

The available information does not establish why the older customers received notifications or whether their complete order records had been retained beyond the stated period. Further details from Keystone’s investigation would be needed to determine how the exposed information was stored and accessed.

Implications for Hardware Wallet Security

Hardware wallets are designed to keep cryptocurrency private keys under the user’s control, typically separated from internet-connected devices. A breach of a retailer’s customer database does not, by itself, establish that wallet devices or private keys have been compromised.

Nevertheless, personal information associated with wallet purchases can create a separate security exposure. Attackers may use leaked details to impersonate customer support representatives, fabricate law enforcement inquiries or send messages that appear connected to a legitimate purchase.

The incident illustrates why protecting customer records is an important complement to securing the devices themselves. Data minimization, access controls, retention limits and prompt breach notifications can all affect the potential consequences of a website compromise.

Outlook

Keystone’s investigation will need to establish the scope of the breach, explain how the vulnerability was exploited and clarify whether historical customer records were retained beyond the company’s stated policy. Affected customers should treat unexpected calls, messages and links concerning their wallets or private keys with caution, particularly when a sender uses accurate order information to establish credibility. The central outstanding questions are how many customers were affected and whether the company can account for the retention and protection of their personal data.