Keystone breach: buyer addresses leaked and a device authenticity key stolen

Keystone, which makes hardware wallets for cryptocurrency, says an attacker who broke into its website last week took two things: shipping details for tens of thousands of buyers, and the key its devices use to prove they’re genuine. Recovery phrases and private keys weren’t exposed. If you’ve bought a Keystone wallet, or plan to, here’s what is known.

What happened

Keystone first said it found unauthorized access to its Shopify-based store on October 20, 2026, and confirmed on October 23 that customer shipping data had been taken, DigitalToday reported. In a fuller update on October 26, Keystone said the attacker got in through a flaw in a third-party monitoring tool used by its website and used it to gain more access, Cointelegraph reported.

According to that update, the data that may have been taken includes:

• 25,964 buyer records from 2024 to 2026, with names, contact details, shipping addresses and order details
• up to 12,873 records from checkouts that were never completed, which Shopify kept

Keystone says payment details, recovery phrases, private keys and wallet passwords were not exposed. It also admitted that some of those buyer records should already have been deleted under its 180-day retention policy, but its automated deletion tool failed without anyone noticing. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote, as quoted by CoinDesk. It says it will now keep customer data for 90 days.

The stolen authentication key is built into devices during production and can’t be changed. Keystone warns it could let counterfeit wallets pass its online authenticity check. It says it will destroy 18,835 unsold devices that contain the key and has paused shipments until devices with a new key are ready.

What this means for you

For wallet owners, the address leak is the bigger everyday risk. Scammers now know that these people own crypto and where they live. Keystone warned that customers may get calls, texts, emails or even letters offering refunds, replacement devices or order changes, and that you don’t need to move your funds because of this breach alone.

On the device itself, Keystone says wallets delivered before October 20 that pass its authenticity check are safe to keep using. If yours arrived after that date, it asks you to contact its support for an extra check before you use it.

What you can do

1. Never type your recovery phrase into anything you didn’t set up yourself, including a device that arrives unexpectedly. No genuine company or support agent needs it.
2. Ignore “recall” or “migrate your assets” messages. Keystone says you don’t need to move funds because of this breach alone.
3. Got a device after October 20? Contact Keystone support through its official site, typing the address yourself, before you use it.
4. Expect scams that know your address. Treat any unexpected parcel, call or letter about your wallet with suspicion.
5. Learn the patterns. See how scammers use leaked data.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each shop its own address, so a leak at one store doesn’t lead scammers straight to your main inbox. We never collect or store the leaked records themselves.

Sources

• Cointelegraph, Keystone breach deepens: Hackers stole key used to verify wallets as genuine, October 27, 2026
• CoinDesk, Crypto wallet maker Keystone to destroy almost 19,000 devices after security breach, October 27, 2026
• DigitalToday, Keystone Shopify store breach leaks customer data for hardware wallet maker, October 27, 2026