The Keystone hardware wallet breach did not touch seed phrases or private keys, but it did expose something the company would rather have erased: customer names, shipping addresses and order details for purchases made more than 180 days ago – exactly the window Keystone’s own policy says that data should have been deleted.
Keystone detected unauthorized access to its official website on October 20 and confirmed on October 23, after reviewing API activity with Shopify, that a third party had obtained customer shipping and order information. Notification emails went out to affected customers between October 23 and 25, and The Block reported on October 25 that several recipients were being notified about orders old enough to fall outside the company’s stated retention window.
What the Keystone hardware wallet breach exposed – and what it did not
According to Keystone’s disclosures, the compromised data set covers names, contact details, shipping addresses and order details, including items purchased and prices paid. The company says payment card numbers, bank details, recovery phrases, private keys and wallet passwords were not compromised. It has blocked the unauthorized access, patched the vulnerability, opened an investigation and warned that scammers are already impersonating Keystone in follow-up phishing attempts.
What Keystone has not disclosed: how many customers were affected, how the attacker gained access, or how far back the exposed records reach. The company has also not publicly explained why records older than its deletion promise were still sitting in the system.
The 180-day deletion promise that quietly lapsed
This is the part of the story that will follow Keystone beyond the news cycle. The firm’s shipping data retention policy states that shipping and order records are automatically deleted 180 days after an order – or after 180 days of no further activity. Customers now say they received breach notifications tied to orders placed well beyond that window. The claims circulate on social media and have not been independently verified, but Keystone has not disputed them either, and its policy pages were unavailable at the time of writing.
For hardware wallet buyers, the exposure is physical rather than cryptographic: names and home addresses tied to crypto purchases are a gift to phishers and, in the worst case, to physical targets. It is the same lesson the industry learned when Ledger’s own customer database leaked – the device was never the weak point; the marketing list was.
What hardware wallet owners should do now
- If you bought a Keystone device, watch for official breach-notification mail and treat any unsolicited “security update” link as hostile.
- Never enter a recovery phrase on any website, including ones that reference this incident.
- Assume your name and address are permanently attached to your device purchase, and screen for follow-up social-engineering attempts.
Independent verification of the 180-day overlap is still pending, and Keystone’s “no seed phrases exposed” assurance is a company assertion rather than an audited finding. We will update this story if the investigation produces numbers.
