Hardware crypto wallet maker Keystone had customer data stolen — names, contacts, delivery addresses and order details. Such information can help fraudsters impersonate customer support: they will know which device a person purchased and how much they paid.

The company reported the leak on October 24, 2026. According to its statement, private keys, wallet recovery phrases and payment data were not affected. Customers were warned about possible fake emails, messages and calls.

How fraudsters can use order information

A hardware wallet stores private keys that allow controlling cryptocurrency. However, protection of the device itself does not prevent leakage of personal data from the online store where it was bought.

In Keystone's case, the attackers got among other things the names of purchased items and amounts paid. These details can make the scam more convincing: a message with the exact wallet model, price and delivery address is easier to take as a genuine communication from the company.

For example, fraudsters may pose as support staff, offer a refund, report a problem with the order or the need to replace the device for free. Under such pretext, they may try to force the buyer to reveal the secret recovery phrase — a set of words that allows restoring access to cryptocurrency.

These are possible scenarios for using the stolen information, not confirmed consequences of this particular leak. Buying a hardware wallet also does not prove that a person owns cryptocurrency, and does not disclose the size of their assets.

What is known about the leak and the promise to delete addresses

In a statement by Keystone, cited by Coin Edition, it says that unauthorized access to the site was discovered on October 20. Access to customer information by outsiders was confirmed on October 23 after checking the activity of the Shopify API — the platform used to run the online store.

Mentioning Shopify does not in itself mean that the entire platform was hacked. The company said it blocked the unauthorized access, fixed the vulnerability and began notifying affected customers.

Meanwhile, on the official privacy protection page Keystone promises to automatically delete delivery information 180 days after the order is placed. A customer can also request earlier deletion — after receiving the device.

The number of affected clients and the period over which records were stolen have not been disclosed yet. Therefore, there is no basis to claim that the leak affected only recent orders or that the company violated its stated data deletion deadline.

How customers can protect themselves from fraudsters

Keystone warns that its support does not ask for recovery phrases and private keys. Even if the sender knows real order details, that does not confirm they represent the company.

  • Do not click on unexpected links from emails and messages. Open the official website yourself.
  • Never share your recovery phrase or private keys, and do not enter them on pages sent by “support”.
  • Verify refund and free wallet replacement offers through official company channels.
  • Do not restore your wallet on a device unexpectedly sent as a replacement.

A request to urgently transfer cryptocurrency to a “safe address” should also raise suspicion. The notification about the customer data leak itself does not mean that funds need to be moved.

Keystone promised to publish a detailed investigation report in the coming days.

Sources: Keystone statement; Coin Edition — report on the leak; Keystone — privacy commitments.