Keystone Data Breach: What Was Exposed, and What It Means for Your Wallet

The Keystone data breach exposed customer names, contact details, shipping addresses and order details from the company's online store, and Keystone says payment details, recovery phrases, private keys and wallet passwords were not part of it. Nothing the company has disclosed touches the device itself, so crypto held on a Keystone wallet is no less safe today, provided you never type your recovery phrase into anything a stranger sends you. What the leak changes is who knows that you own a hardware wallet and where it was delivered, and that's the risk to plan around, whether you already own a Keystone or you're still deciding which wallet to buy.

What the Keystone data breach exposed

In a post on X on 24 October 2026, Keystone said it detected unauthorized access to its official website on 20 October and, after checking API activity with Shopify, confirmed on 23 October that a third party had obtained customer shipping information. The fields it listed were names, contact details, shipping addresses and order details, including the items bought and what they cost. Keystone said it had blocked the access, fixed the vulnerability, opened an investigation and started emailing affected customers, and it promised a detailed report.

Some answers are still missing. As of 26 October, Keystone hadn't said how many customers were affected, how the attacker got in or how far back the records go, according to The Block's report. If you've ordered from Keystone and haven't had an email yet, don't read that as an all-clear while the notices are still going out.

The 180-day deletion promise

Keystone's Privacy Promise page says all shipping information is automatically deleted 180 days after an order is placed, a point the company also made on X in January and March. Several customers told The Block their data was exposed even though their last order was older than that, one of them saying 214 days had passed; The Block couldn't verify those accounts, and Keystone hasn't said whether its policy was followed. Its help center article on deletion adds that city and country records aren't deleted and that Shopify handles the final step, which is a narrower promise than the headline page makes.

Trezor ran into the same gap earlier in 2026. Its shipping provider ShipMonk had confirmed in writing that old order data was deleted, and Trezor later found it wasn't, so US orders from November 2019 to August 2021 ended up in the leak we covered in our piece on the ShipMonk breach. A retention policy holds only as well as every vendor that touches the order, and a buyer has no way to audit that chain as a customer.

Four wallet makers, one pattern in 2026

Keystone is the fourth hardware wallet company in 2026 to disclose a leak of customer order data. Each one came from the store, payments or shipping side of the business, and none of the four companies has said its devices or customers' keys were affected.

The table says less about any one wallet than about how wallets get sold. Most makers run their stores, payments and delivery on a small set of outside platforms, so a breach at one company tells you very little about the security of its hardware, and switching brands doesn't take your address out of the system. We sell the Ryder One through a Shopify store too, which means everything in this section applies to us as well: any company that ships you a device holds your name and address for at least as long as delivery takes.

If you own a Keystone

Keystone's warning lines up with what SafePal told its customers after its own leak: the order data leaves wallets untouched while making targeted scams more convincing. A sensible response looks like this:

• Treat any call, text, email or letter about a Keystone refund, replacement device or a "fix" to your order as a scam, which is how Keystone itself describes the follow-ups it expects.
• Never enter your recovery phrase into a device you didn't order, a website or an app, and remember that Keystone says it will never ask for it.
• Reach Keystone by typing its web address yourself or by emailing support@keyst.one, and ignore links in messages you weren't expecting.
• If you've already typed your phrase in response to one of these messages, treat that wallet as compromised: set up a new wallet on a device you trust and move what's left to it straight away.
• Plan for the scams to continue for a long time, because a leaked customer list doesn't expire, and if you're worried about your physical safety, talk to local police.

You don't need to move funds only because your order data leaked, and our guide to how a cold wallet can be hacked explains why attackers usually go after the recovery phrase.

If you're choosing your first hardware wallet

For a first-time buyer, the breach is a reason to change how you order rather than a verdict on Keystone's hardware, which signs transactions over QR codes and publishes its firmware as open source, as we laid out in our Keystone wallet vs Ryder One comparison. The questions that separate one wallet from another are still how it protects the keys, how you back up and recover, and whether its screen shows what you're signing, and our checklist on your first hardware wallet walks through them.

Where you can control the risk is the order itself. Buy from the maker or an authorized reseller, which our guide on where to buy a hardware wallet safely covers after the 2026 tampered-device case. Before you pay, check how long the seller keeps shipping data and whether it will delete yours after delivery, since Keystone, for one, offers deletion on request. Shipping to a carrier pickup location or a work address and using a separate email for purchases both shrink what a future leak can reveal about you.

If you've narrowed it down and want to see how an NFC-only wallet handles signing and backup, you can compare the details on the Ryder One product page next to the other wallets on your list.