Hardware Wallet Manufacturer Keystone Reports Data Breach Affecting Customer Shipping Information
In a recent security incident, Keystone revealed that unauthorized parties accessed shipping information of hardware wallet purchasers, sparking concerns about potential physical threats and raising doubts about the company's data deletion practices.
A security breach at Keystone, a manufacturer of cryptocurrency hardware wallets, has resulted in the exposure of customer data to malicious actors, sparking widespread worry about the potential for targeted fraud schemes and physical security threats.
In an announcement made on Saturday, Keystone reported that it had identified unusual activity on its systems at the beginning of the week. Following a thorough examination of API activity in collaboration with Shopify, the company confirmed on Friday that an unauthorized individual had gained access to customer shipping data. The compromised information encompassed customer names, contact information, delivery addresses, and additional order-related details, including the specific products purchased.
"We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers," said the company.
According to Keystone's warning, the compromised data has the potential to be exploited in targeted phishing campaigns. Additionally, security researcher Taylor Monahan voiced concerns that the leak of shipping addresses could leave customers vulnerable to physical assaults and abduction attempts.
According to data compiled by blockchain security company CertiK, there were 52 confirmed wrench attacks documented globally during the first six months of 2026, representing a 33% increase compared to 39 incidents during the equivalent timeframe in the previous year. These criminal acts, frequently referred to as "wrench attacks," entail the use of physical intimidation or force to compel cryptocurrency owners to hand over their digital assets.
"Again, we're truly sorry to everyone affected," Keystone said. The company did not disclose how many customers were impacted.
Keystone questioned over promise to delete customer data
The security incident has additionally prompted inquiries regarding Keystone's management of historical customer records.
According to a blog post published by Keystone in 2023, the company stated it had shortened its customer data retention timeframe to 180 days in response to security breaches that had impacted other hardware wallet producers.
Despite this policy, several customers reported receiving breach notification emails even though they had made their purchases more than two years in the past, prompting concerns about which data Keystone actually retained and whether the notifications suggest that historical order information was not purged as the company had stated.
A user on X who goes by the handle "OG DEGEN" reported receiving a telephone call from a fraudster who claimed to be law enforcement officials investigating a fraud matter. The individual suspected the caller had obtained their personal details through a Keystone purchase made in 2024, judging by the specific personal data the caller referenced.
"I think their plan was to convince me that my private keys had been exposed and then send me a phishing link to supposedly reset them," they wrote on X.
Another individual on X, using the username trintaetres, similarly reported receiving the breach notification email despite having purchased their device more than two years prior.
Cointelegraph contacted Keystone to ask how customer information from purchases made more than 180 days earlier could have been exposed despite its previously announced retention policy, and how many customers were affected. The company did not respond by publication time.