Keystone data breach: what to do if you bought a wallet
Keystone says a third party got customer data: address and order details, no seed phrase. What that means and what to do now.
Hardware wallet maker Keystone said on 24 October 2026 that a third party has obtained customer data through its official web shop. According to Keystone, it spotted unauthorised access on 20 October and confirmed on 23 October, after checking API activity with Shopify, that a third party obtained customers' shipping data: names, contact details, addresses and order details. Payment details, recovery phrases, private keys and wallet passwords were not affected, according to Keystone. The company has not said how many customers are involved.
The Keystone data breach in short
- What Keystone says: it saw unauthorised access to the official website on 20 October; on 23 October it confirmed that a third party obtained customers' shipping data. Keystone's post on X is dated 24 October.
- What was obtained: names, contact details, shipping addresses and order details, which also show which products you bought and what you paid.
- What Keystone says was not affected: bank and card details, recovery phrases (seed phrases), private keys and wallet passwords.
- How many customers: not known. Keystone is emailing the affected customers.
- How the attacker got in: not known. Keystone writes that it has blocked the access, fixed the vulnerability and started an investigation. A detailed report will follow ‘in the coming days’.
- Your funds themselves: your coins are not held by Keystone. A hardware wallet keeps the keys on the device; according to Keystone, the breach concerns the web shop and customer data, not keys or recovery phrases.
- The real risk: a list of names, home addresses and what someone spent on crypto hardware is attractive to scammers who pose as the company.
Timeline of the breach
According to its own website, Keystone is based in Hong Kong. The company does not say in which countries the affected customers live.
What Keystone promised about deleting addresses
Keystone advertises privacy. Its own privacy promises page says: ‘All shipping information is automatically deleted 180 days after your order is placed.’ According to The Block, the company repeated this in posts on X in January, March and August 2026.
Here is our own calculation, based on that promise: with access on 20 October, orders placed before 23 April 2026 should already have been deleted. Customers report on X that they received a breach notification anyway. One customer was reportedly affected 214 days after their last order, and another reports an order from more than two years ago. The Block could not verify these accounts and writes that Keystone has not said whether it kept to its 180-day policy.
There is a further caveat in Keystone's own rules. According to The Block, the privacy policy (last updated in May 2021) words the 180 days differently from the promises page, and a help centre article says that city and country are kept and that Shopify handles the deletion. Whether that explains the difference is not clear.
Why an address leak weighs more with crypto
With an ordinary web shop, a leaked address is annoying. With hardware wallets it is different, for two reasons.
- The address belongs to an order that says something. Whoever buys a hardware wallet probably holds crypto. The order details also show which model and what amount.
- Scammers work with real data. An email or phone call that mentions your name, address and order sounds credible. Keystone itself warns about people posing as the company, by phone, text message, email or post, who offer a refund, a replacement device or a ‘fix’ for your order or address.
According to The Block, one customer reported a phone call from a number that resembled a Montreal police number, quoting details of a 2024 order; that was before Keystone's announcement. The Block could not verify this either.
What you can do now
- Don't wait for an email. If you have ever ordered anything from Keystone, assume your address may be among the data until Keystone says otherwise.
- Never enter your recovery phrase on a device you did not order yourself. That is also literally Keystone's advice. A genuine provider never asks for it, by phone or email.
- Don't open links in messages that appear to come from Keystone. Go to keyst.one yourself and check there.
- Don't call back a number from a message. Anyone who says you will get money back or that your device must be replaced is a reason to hang up.
- Think about your address for your next order. A pickup point or PO box address is an idea if the seller allows it; that is a tip from us, not advice from Keystone.
- Review your own security. Our crypto security checklist covers the basics.
If you need to choose a new wallet, first look at the comparison in our guide choosing a crypto wallet. If you are looking for a device, you can also look at the Blockstream Jade review, a partner of ours; with any provider, check what it says about addresses and retention periods.
Not the first hardware wallet maker with a breach in 2026
According to The Block, other providers also reported leaks of customer data this year:
We have not checked these figures with Trezor or SafePal ourselves. The pattern is the same, though: the devices themselves are not cracked, but the chain around them (web shop, shipping partner, tracking page) leaks.
What does this mean for you as a European investor?
Across Europe. Keystone sells worldwide and names no countries. If you ordered a Keystone, you should allow for the possibility that your data is among it.
The Netherlands and Belgium. Watch out for scammers posing as the police, a bank or a supplier. A genuine company never asks for your recovery phrase.
Germany, France, Spain, Portugal and Poland. What a data breach means for your rights depends on the supervisor and on where the company is based. Keystone is in Hong Kong; whether it has to notify under European privacy rules, the sources do not say. We write nothing about that which we cannot substantiate.
What is not certain yet
- The number of affected customers and the countries where they live.
- How the attacker got in, and whether the attacker has been identified.
- Whether Keystone kept to its 180-day promise. The customer accounts on X have not been verified.
- Keystone's detailed report, which will follow ‘in the coming days’. We will need to update this article with it.
- The Montreal call is a single customer's account, not confirmed.
This article is not investment advice. Crypto can lose a lot of value and you can lose your entire stake.
Frequently asked questions
Is my crypto safe after the Keystone data breach?
According to Keystone, recovery phrases, private keys and passwords were not affected. Your coins are on your own device, not with Keystone. The risk lies in scams using your address and order details.
What data was leaked at Keystone?
Names, contact details, shipping addresses and order details, including what you bought and what you paid. According to Keystone, payment details were not leaked.
When did the Keystone breach happen?
Keystone saw the unauthorised access on 20 October 2026, confirmed on 23 October that shipping data had been obtained, and announced it on X on 24 October.
Do I need to replace my Keystone wallet?
Nothing in the sources points that way. Keystone says private keys and recovery phrases were not affected. Just don't enter your recovery phrase on a device you did not order yourself.
How do I recognise a scam after this breach?
A message that asks for your recovery phrase, promises money back or offers a replacement device is a scam. Keystone says so itself: be careful with people posing as Keystone.
Sources
Read on 26 October 2026.
- Keystone: post on X, 24 October 2026, with the dates of 20 and 23 October.
- Keystone: privacy promises page, with the 180-day retention period and the Hong Kong address, accessed on 26 October 2026.
- The Block: Keystone customers say breach exposed data the hardware wallet maker promised to delete, 25 October 2026.
- Crypto Briefing: Keystone Hardware Wallet says website breach exposed customer data, 24 October 2026.