Keystone Hardware Wallet Breach Exposes Customer Data, Sparking Security and Privacy Concerns

Keystone disclosed on Saturday that it detected suspicious activity earlier that week and, after reviewing API interactions with Shopify on Friday, confirmed that a third party had gained unauthorized access to customer shipping data. The compromised information included names, contact details, delivery addresses, and order specifics such as purchased products.

The company reported that it immediately blocked the unauthorized access, fixed the security vulnerability, initiated an investigation, and began notifying affected customers through email.

Keystone warned that the exposed data could be exploited for targeted phishing scams. Security researcher Taylor Monahan additionally expressed concern that revealing customers' shipping addresses could put them at risk of direct physical attacks or kidnappings.

Blockchain security firm CertiK documented 52 confirmed instances of physical 'wrench attacks' globally in the first half of 2026, marking a 33% increase compared to 39 cases during the same timeframe in 2025. These attacks involve coercion or violence to force cryptocurrency holders to relinquish access to their assets.

Keystone issued an apology to all affected customers but did not specify the number of individuals impacted by the breach.

The incident has also raised scrutiny over Keystone’s data retention practices, particularly concerning older customer records.

In a 2023 blog post, Keystone stated it had shortened its customer data retention period to 180 days following prior security incidents affecting other hardware wallet companies.

Despite this, some customers reported receiving breach notifications even though they purchased their devices over two years ago, prompting questions about whether Keystone retained older order information contrary to its stated policy.

An individual using the handle 'OG DEGEN' on X shared that they received a scam call from someone impersonating law enforcement investigating fraud. Based on details mentioned by the caller, the user suspects the scammer accessed their data from a Keystone order placed in 2024.

The user explained on X that the scammer’s likely aim was to trick them into believing their private keys were compromised and then send a phishing link to supposedly reset those keys.

Another X user, trintaetres, also reported receiving an email alert about the breach despite making their purchase more than two years ago.

Cointelegraph reached out to Keystone seeking clarification on how customer data older than 180 days might have been exposed given the company’s prior data retention claims, and to learn how many customers were affected. Keystone had not responded by the time of publication.

This breach highlights significant vulnerabilities in customer data security and raises important questions about data handling and retention practices within the hardware wallet industry. Protecting sensitive information is crucial to prevent both digital fraud and physical threats to cryptocurrency users.

The incident underscores the critical importance of robust data security measures and transparent data retention policies in safeguarding customers against increasingly sophisticated cyber and physical attacks.