Keystone Breach Exposes Hardware Wallet Buyers’ Addresses
Ecosystem
English
News
Markets
Features
Research
Opinion
Podcasts
Newsletters
Commissioned
About
- DOGE: $0.07720 (0.36%)
- TRX: $0.3302 (0.47%)
- LINK: $11.45 (0.35%)
- ZEC: $1,213.70 (1.20%)
- ADA: $0.2041 (0.58%)
- XRP: $1.29 (0.48%)
- ETH: $2,324.24 (0.94%)
- BTC: $80,185.78 (0.40%)
- XMR: $588.85 (3.36%)
- BNB: $741.85 (0.10%)
- XLM: $0.1691 (0.47%)
- SOL: $101.34 (0.32%)
- HYPE: $76.85 (0.94%)
Written by Felix Ng (staff editor) and edited by Yohan Yun (staff editor)
Keystone says website breach exposed hardware wallet buyers’ addresses
Latest News
Published: Oct 26, 2026
A security researcher warned that the leaked shipping details could expose crypto holders to targeted scams and physical attacks.
Crypto hardware wallet maker Keystone has disclosed a website security breach that exposed customer information to attackers, raising concerns about targeted scams and physical attacks.
Keystone stated on Saturday that it detected suspicious activity earlier in the week and confirmed on Friday, after reviewing API activity with Shopify, that an unauthorized third party had accessed customer shipping information. This included names, contact details, shipping addresses, and other order details, such as items bought.
“We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” said the company.
Keystone warned that the exposed information could be used for targeted phishing attacks. However, security researcher Taylor Monahan also raised concerns that leaking shipping addresses could expose customers to physical attacks and kidnappings.
Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 during the same period last year. Such crimes, commonly called “wrench attacks,” involve using physical threats or violence to force cryptocurrency holders to surrender their assets.
“Again, we’re truly sorry to everyone affected,” Keystone said. The company did not disclose how many customers were impacted.
Keystone questioned over promise to delete customer data
The breach has also raised questions about Keystone’s handling of older customer information.
In a 2023 blog post, Keystone stated it had reduced its customer data retention period to 180 days following security incidents affecting other hardware wallet manufacturers.
However, some customers said they received breach notifications despite purchasing their devices more than two years ago, raising questions about what information Keystone retained and whether the notifications indicate that older order records were not deleted as promised.
Related:
- Italy investigates government email breach linked to Revolut data leak
- Magazine: AI agents help rescue ETH’s Glamsterdam fork, ‘Steal My Bitcoin’ site: Hodler’s Digest
Subscribe to daily byte-sized crypto news from Cointelegraph Subscribe
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information.