Keystone, a maker of self-custody hardware wallets, says an attacker broke into its official website and left with part of its customer database. According to Cointelegraph, the company detected unauthorized access on October 20, 2026, and confirmed on October 23 that an unidentified third party had pulled customer information after it reviewed Shopify API activity tied to the site. The exposed records include customer names, contact details, shipping addresses, and order history down to the items bought and the prices paid.
The company was clear about what the breach did not reach. Payment card and bank details were not exposed. Recovery phrases, private keys, and wallet passwords are never stored on the website and were not part of the leak. For a hardware wallet that distinction is real: the device and the secrets it guards are intact, and no funds can move because of this incident alone.
Names and addresses, not keys
The reassurance is worth stating plainly, and then qualifying just as plainly. Nobody's crypto is draining today as a direct result of this breach, because the thing that moves funds, the seed phrase, never lived on Keystone's web server. That is the whole point of a hardware wallet: the keys stay on the device, offline, and the website is just a storefront.
The value of what leaked is not in the data itself but in what it points to. An order record showing a name, a home address, and a purchase of a hardware wallet is a short, high-quality list of people who almost certainly hold crypto and have chosen to keep it in their own custody. That is a different class of exposure than a generic retail leak, and it is the part of the story that deserves attention after the initial relief about keys.
A buyer list is a target list
Consider what a hardware wallet purchase actually signals. Someone who buys a cold-storage device is telling the seller, in effect, that they hold assets they want to protect and intend to control directly rather than leave on an exchange. Pair that signal with a verified home address and the order value, and the leaked file reads less like a mailing list and more like a curated set of likely crypto holders mapped to physical locations.
That is the precondition for what the industry calls a wrench attack, shorthand for coercing someone in person to surrender their keys. This is analysis of what the exposed data enables rather than a claim about any specific threat Keystone has reported; the company itself flagged the risk of scams, and the physical-safety concern follows directly from the combination of a crypto-buyer list and real addresses. It is also why a breach that touched no private keys can still matter a great deal to the people in the file.
Impersonation is the faster threat
The more scalable risk is phishing, and it starts almost immediately after a leak like this. With a name, an address, and the specifics of an order, a scammer can pose convincingly as Keystone support through a phone call, a text, an email, or even physical mail. The approach lands because the caller can recite what the target actually bought and where it shipped, which is exactly the detail a real support agent would know. The pitch tends to be a refund, a free replacement device, or help resolving an address or order problem.
The destination is always the same: get the victim to reveal a recovery phrase, or accept a tampered device in the mail. A hardware wallet maker will never ask for a recovery phrase, under any circumstances, through any channel. Any message that works toward that question, however polished, is an attack. The same logic applies to minimizing how much identifying data you hand to any crypto service in the first place, which is part of the appeal of lower-verification options elsewhere in the ecosystem: a smaller data footprint means a smaller blast radius when a vendor is breached.
Steps for anyone who bought a Keystone
Treat any unsolicited Keystone contact as hostile until you have independently verified it through the official site you typed in yourself, not a link someone sent you. Never type or photograph a recovery phrase for anyone, and never enter it anywhere except directly on the device. Download firmware and companion apps only from official sources, and be skeptical of any "urgent update" that arrives by message. If the exposure of your home address and order value is a personal-safety concern, the physical side is worth thinking through as carefully as the digital one.
The honest limits of what is known matter here too. Keystone has not said publicly how many people were affected, how long the unauthorized access lasted, or who was behind it, beyond confirming the Shopify API activity that revealed the extraction. Until those details are filled in, the safe assumption for anyone who ever ordered from the site is that their name, address, and order history are in someone else's hands.
Overview
Keystone, a self-custody hardware wallet maker, disclosed that an attacker accessed its website on October 20, 2026, and confirmed on October 23 that customer names, contact details, shipping addresses, and order records were exposed, traced through Shopify API activity. Payment details, recovery phrases, private keys, and wallet passwords were not compromised, so no funds are at direct risk from the breach itself. The danger is second order: a verified list of hardware wallet buyers tied to home addresses is a ready-made target set for impersonation scams and, in the worst case, physical coercion. Buyers should treat any surprise Keystone outreach as a scam, never share a recovery phrase, and use only official download sources. Keystone has not disclosed the number of people affected, the duration of access, or the actor.
