Keystone, a maker of hardware wallets for cryptocurrencies, said unauthorized access to its online store exposed customer names, contact details, shipping addresses and order details, according to a company statement published October 24.
The company said it detected the unauthorized access to its Shopify-based store on October 20 and confirmed it on October 23. Payment information, bank details, recovery phrases, private keys and wallet passwords were not affected, Keystone said.
Keystone had publicly promised to delete shipping data within 180 days of an order and said, unlike other wallet makers, it did not keep customer data indefinitely. Affected customers disputed that: one said they bought their wallet more than two years ago, while another said 214 days had passed since their last order, well beyond the promised window.
Keystone apologized to customers. “You trusted us with those details, and we're sorry we didn't keep them safe,” the company said. It also warned users to never share their recovery phrase or private wallet keys with anyone.
Some customers reported attempted scams in which attackers referenced details from their past orders, raising concerns about phishing and physical safety risks for owners of hardware wallets whose home addresses were exposed.
Keystone has not disclosed how many customers were affected, how the breach occurred, or the identity of the attacker.
A similar case occurred in the industry in 2020, when a breach at Keystone rival Ledger exposed data on roughly 272,000 customers; some of them later received fraudulent letters by mail asking for their recovery phrases.
