Keystone Hardware Wallet Data Breach: What to Do

In short: Keystone, a hardware wallet maker, confirmed on October 24 that a breach of its website exposed customer names, home addresses, and order details after it detected unauthorized access on October 20 and confirmed the theft three days later, per Keystone's disclosure as reported by crypto.news. Private keys, recovery phrases, passwords, and payment or bank details were not exposed. Keystone has not yet said how many customers were affected or who was behind the intrusion.

If you've bought a Keystone hardware wallet and are wondering whether you're affected, this breach involved the website Keystone uses to take orders, not the wallet device itself or the cryptocurrency stored on it. Here's what was taken, what wasn't, and what to do while Keystone's investigation continues.

What data did the Keystone breach expose?

The breach exposed information collected during hardware wallet purchases: contact details, shipping addresses, products ordered, and their prices. Keystone detected the unauthorized access to its website on October 20, then confirmed on October 23 — after reviewing application programming interface activity with its e-commerce provider, Shopify — that a third party had obtained customer shipping information, according to Keystone's October 24 disclosure. CoinCentral's reporting confirms the same categories: names, addresses and order details.

What data was not exposed in the breach?

Keystone says payment card information, bank details, recovery phrases, private keys and wallet passwords were not exposed, per the company's disclosure. That distinction matters: whoever accessed Keystone's website got your name and address, not the keys that control any cryptocurrency on your device.

Is my cryptocurrency at risk from this breach?

Not directly, from the stolen data itself. Keystone told customers to never share a recovery phrase or private key, and never to enter a recovery phrase into a device they did not order — advice aimed at the scams this breach could enable, not at a compromise of the wallets themselves, the company warned. Security researcher Taylor Monahan raised a separate concern: leaked shipping addresses could expose hardware wallet buyers to physical risks, including robbery, according to crypto.news. There's no confirmed evidence yet that the stolen data has led to any physical attacks.

What are the signs of phishing from this breach?

Expect contact that uses the exposed details to sound legitimate. Keystone warned scammers could impersonate the company through email, phone calls, text messages or physical mail, with fake refunds, replacement devices, or requests to "correct" a delivery address, the company said in its own statement, posted on X. Because scammers now have real names, addresses, and order details, these messages may reference your actual purchase to seem convincing. Keystone's advice: go directly to its website and contact official support if you receive anything suspicious, rather than replying or clicking a link, per the disclosure.

What should I do if I'm a Keystone customer?

1. Treat any email, text, call, or letter claiming to be from Keystone with suspicion — especially anything about refunds, replacements, or fixing a delivery address, as Keystone itself advised.
2. Contact Keystone only through its official website, never through a link or phone number supplied in the message, per the company's guidance.
3. Never share a recovery phrase or private key with anyone, and never type one into a hardware device you didn't order yourself, per Keystone's own warning.
4. Since your home address is part of what leaked, be alert to unsolicited deliveries, visitors, or mail referencing your Keystone order, given the physical-security concerns security researcher Taylor Monahan has raised about exposed shipping data for hardware wallet buyers, as crypto.news reported.
5. Use the Federal Trade Commission's step-by-step recovery guidance at IdentityTheft.gov if you suspect your information has been misused; it walks through limiting damage and reporting identity theft, per the FTC.
6. For a broader walkthrough of what to do after any breach, see Privacy Unpacked's data breach checklist.

What do we not yet know about the breach?

Keystone says it has blocked the unauthorized access, corrected the vulnerability and opened an investigation, according to crypto.news. What it hasn't explained is how the attacker got in — a stolen API credential, an application flaw or another weakness in its website infrastructure — or exactly when the access began. Until that investigation closes, assume your order details are in circulation and check any Keystone contact against the steps above.