A hardware wallet is designed to protect the keys to your crypto. But a purchase record can reveal who bought one, what they ordered and where it was delivered. Keystone says unauthorized access to its website exposed customer information, creating risks even though wallet credentials were not affected.
- Keystone says names, contact details, shipping addresses and order information were exposed.
- The company says payment information and wallet credentials were not exposed.
- The number of affected customers, how the attacker gained access and whether the data has been misused remain unclear.
- No physical attack linked to the incident has been confirmed.
What Keystone says was exposed
Keystone said it detected unauthorized access to its official website and confirmed the theft of customer data three days later. As part of its investigation, the company said it reviewed API activity with Shopify.
According to Keystone’s disclosure, the exposed information included customer names, contact details, shipping addresses, products ordered and prices. Those details can make impersonation attempts more convincing. A message mentioning a specific wallet model or order may seem more credible than a generic warning.
Keystone said payment card information, bank details, recovery phrases, private keys and wallet passwords were not exposed. These are the company’s assurances. The disclosures available so far do not include independent forensic findings that confirm the scope of the breach.
Keystone’s disclosure concerns customer records held through its online store. The company has not reported a compromise of wallet firmware or cryptographic keys. A shipping address also does not prove that someone still owns a wallet or holds cryptocurrency. It can, though, identify a buyer as a potential target.
The Shopify reference does not establish a Shopify breach
An API, or application programming interface, lets software systems exchange information. Keystone’s reference to reviewing Shopify API activity does not establish that Shopify’s platform was breached, nor does it explain how the attacker gained access.
Keystone has not disclosed how many customers were affected, where they live, when the unauthorized access began, who was responsible or which weakness the attacker exploited. The company said it blocked the access, corrected a vulnerability, opened an investigation and began notifying affected customers. It also promised a detailed incident report. The disclosures cited here do not make clear whether it has since published one.
Why order data can create security risks
A name and address will not unlock a wallet. But they can help someone craft a more targeted phishing attempt, a deceptive message meant to trick someone into sharing sensitive information or taking an unsafe action. Keystone warned customers to watch for impersonation attempts by email, phone, text or physical mail, including fake refund, replacement-device and delivery-correction messages.
“NEVER share your recovery phrase or private keys.”
A recovery phrase is a set of words used to restore access to a crypto wallet. Anyone who obtains it may be able to control the funds in that wallet. No legitimate support agent needs your recovery phrase to process a refund, correct a delivery or replace a device.
If you receive an unexpected message, do not click its links or reply with sensitive information. Find Keystone’s official website yourself and use a support channel listed there. Never share your recovery phrase or enter it on a website in response to a message.
If you have already disclosed your recovery phrase, treat the wallet as compromised. Use a trusted device to create a new wallet with a new recovery phrase, then move any remaining funds to it. Do not reuse the exposed phrase.
Exposed shipping addresses can also create a physical-security risk. Security developer Taylor Monahan warned that such information could put wallet buyers at risk. A “wrench attack” means using threats or violence to force someone to hand over access to cryptocurrency. That risk should not be confused with a reported outcome: no physical attack linked to Keystone’s breach has been confirmed.
Ledger’s breach shows why address data matters
Ledger’s 2020 customer-data breach offers a cautionary example. It does not show that Keystone’s incident is the same size, has the same cause or will have the same consequences. Ledger’s initial investigation identified approximately one million compromised email addresses and detailed personal information belonging to around 9, 500 customers. After the database appeared publicly in December 2020, the company acknowledged a larger exposure involving roughly 272, 000 records containing names, postal addresses and telephone numbers.
In April 2025, crypto.news reported on fraudulent letters sent to Ledger customers, urging them to scan QR codes and enter their recovery phrases. Investigators had not established that every reported letter came from the 2020 database. These reports show how exposed customer information can be abused. They do not prove that Keystone’s data has been used in the same way.
Key questions and answers
-
What information does Keystone say was exposed?
Names, contact details, shipping addresses, products ordered and prices.
-
Were wallet keys or payment details exposed?
Keystone says payment and bank details, recovery phrases, private keys and wallet passwords were not exposed. The available disclosures do not include independent forensic confirmation.
-
Was Shopify breached?
Keystone has not said Shopify’s platform was breached. Its reference to reviewing API activity does not explain how the attacker gained access.
-
What should affected customers do?
Watch for unexpected messages about refunds, replacement devices or deliveries. Contact Keystone only through a support channel you have independently verified on its official website. Never disclose your recovery phrase. If you already have, move any remaining funds to a new wallet created with a new phrase.
-
Have physical attacks been linked to the breach?
No physical attack linked to the incident has been confirmed. Exposed addresses may create a targeting risk, but an address does not prove that someone still owns a wallet or holds crypto.
Keystone’s disclosure is not evidence that customers’ wallets have been emptied or that its devices were compromised. It does show that protecting crypto also means protecting the personal data tied to buying and using it.
