Keystone Breach Exposed Buyer Data It Promised to Delete

Keystone's help page makes buyers a gentle, specific promise. If you haven't ordered in 180 days, your name, phone number, shipping address and email are wiped, so the company won't "hold onto it."

A breach at the hardware wallet maker shows that promise didn't hold for everyone. On Monday, Keystone said its official Shopify store had produced 51,083 purchase records. Of those, 25,119 had been deleted under the 180-day rule. The remaining 25,964, dating from 2024 to 2026, may have been stolen.

Keystone blamed its own automated deletion tool. "The tool did not operate reliably," the company said. "Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period."

The Attacker Also Took a Key That Vouches for Devices

The same update carried a second, arguably bigger problem. Keystone said the attacker also stole a key used to verify that its wallets are genuine. With it, someone could produce counterfeit devices that pass Keystone's authenticity checks.

Keystone said it will destroy 18,835 devices in its inventory that contain the compromised key, and it has suspended shipments of devices that use it.

For people who already own one, the company drew a line at 20 October:

• Devices delivered before 20 October should be considered safe if they pass authentication.
• For devices delivered after that date, Keystone said authenticity cannot be guaranteed.

It is not yet clear whether any counterfeit devices have actually been made with the stolen key.

How the Breach Unfolded

Keystone said it detected unauthorized access to its official website on 20 October. After reviewing API activity with Shopify, it confirmed later that week that a third party had obtained customer shipping information: names, contact details, shipping addresses and order details, including the items bought.

The company said it blocked the access, fixed the vulnerability and opened an investigation. Its first statement did not say how many customers were affected. The record counts came only with Monday's update.

That update also explained the route in. Keystone said the attacker exploited a vulnerability in a third-party monitoring tool used by its website to escalate privileges. The attacker may also have reached 12,873 incomplete checkout records that Shopify had kept.

Why a Shipping Label Matters So Much Here

For most online shops, a leaked address is an unpleasant nuisance. For a hardware wallet company, it is a list of homes where someone probably keeps crypto.

Security researcher Taylor Monahan warned that leaking buyers' shipping addresses could expose them to physical threats, including robbery and kidnapping.

Keystone knew this risk well. Its own shipping data retention policy says: "The leaking of the physical address is also a very dangerous leak because it could result in kidnapping or 5 dollar wrench attacks." A wrench attack is the blunt version of crypto theft, where someone threatens the owner in person instead of hacking a device.

That is what makes this breach sting. The 180-day rule wasn't a bit of legal small print. It was a thoughtful answer to the exact danger the company had named, written in plain, reassuring language for people who had chosen Keystone because they care about keeping their holdings private. The same page also said Keystone would stop collecting email addresses and email subscriptions.

A Promise Is Only as Good as Its Plumbing

The policy itself was sound. The failure, by Keystone's account, was in the machinery meant to carry it out: deletion jobs that failed quietly and went unnoticed.

It's an uncomfortable lesson for any brand built on trust. Customers can read a privacy promise, but they can't see whether the tool behind it is running. Keystone's explanation is candid about that gap, and the record counts it published give buyers a clearer sense of scale than its first statement did.

What buyers still don't know is who the attacker is. Anyone who purchased from Keystone's store between 2024 and 2026 now has to assume their address may be in someone else's hands, and anyone who received a device after 20 October can no longer rely on its authenticity check alone.