Keystone Reports Security Breach Exposing Customer Shipping Information
Keystone, a manufacturer of crypto hardware wallets, has revealed a security breach that has compromised customer shipping information. This breach has raised significant concerns regarding the potential for targeted scams and physical attacks against cryptocurrency holders.
On Saturday, Keystone reported that it had detected suspicious activity earlier in the week. After reviewing API activity with Shopify, the company confirmed that an unauthorized third party had accessed sensitive customer information, including names, contact details, shipping addresses, and order specifics. In response, Keystone stated that it has blocked access to the compromised data, fixed the vulnerability, initiated an investigation, and is in the process of notifying affected customers via email.
The company cautioned that the leaked information could be exploited for targeted phishing attacks. Security researcher Taylor Monahan expressed additional concerns, noting that the exposure of shipping addresses could lead to physical threats, including attacks and kidnappings. According to blockchain security firm CertiK, there were 52 verified wrench attacks globally in the first half of 2026, marking a 33% increase from the previous year. These attacks involve using physical violence to coerce cryptocurrency holders into surrendering their assets.
Keystone's Response to Customer Concerns
Keystone issued an apology to those affected by the breach but did not disclose the number of customers impacted. The incident has also prompted questions regarding the company's data retention policies. In a blog post from 2023, Keystone stated it had reduced its customer data retention period to 180 days following security incidents involving other hardware wallet manufacturers. However, some customers reported receiving breach notifications despite having purchased their devices over two years ago, raising concerns about the retention of older customer information.
Cleared for Release
One user on X, known as "OG DEGEN," reported receiving a call from a scammer posing as law enforcement, claiming to investigate a fraud case. The user suspected that the scammer obtained their information through a Keystone order placed in 2024, as the caller referenced personal details. Another user, trintaetres, also received a breach notification despite purchasing their device more than two years prior.
Cointelegraph reached out to Keystone for clarification on how customer information from purchases made over 180 days ago could have been exposed, as well as the total number of customers affected. The company had not responded by the time of publication.
