Keystone has apologized to customers after a third party obtained shipping information belonging to users of its hardware wallets, an incident that security researchers warn can carry risks well beyond phishing.
In a post on X over the weekend, the Hong Kong-based company said it had detected unauthorized access to its systems earlier in the week. An investigation established that a third party obtained customer shipping data, including names, contact details, shipping addresses and order details such as items purchased and prices paid.
Keystone said it had fixed the vulnerability. The company did not disclose how many users were affected.
Why leaked addresses carry elevated risk
Patching the flaw that exposed the data does not undo the exposure for affected customers. Because shipping addresses were among the leaked details, attackers could use them to locate victims' homes.
Security researcher Taylor Monahan warned that the primary danger in a leak of this kind is not phishing but physical violence, pointing to assaults and kidnappings as the realistic threat.
For breach victims, relocating to a new address is the safer course. There have also been reports of people outside the crypto industry being assaulted or kidnapped after renting a home previously occupied by a crypto investor whose data had been breached, which makes background checks on a property's past tenants or owner worth considering.
Physical attacks on the rise
So far in 2026, crypto-related physical attacks have reached 122 across 31 countries, with France identified as the hot spot, according to the figures cited. More than $44 million has been lost to these so-called wrench attacks.
Chainalysis estimated losses at over $100 million as of August, underlining the scale of the threat vector facing crypto holders.
Keystone's exposure may be wider than stated
Keystone says it retains new user data for only six months before deleting it. However, one victim said he purchased Keystone hardware in 2024 and his data was still leaked, suggesting the impact may extend beyond the company's stated retention window.
The disclosure follows a series of security setbacks across the wallet sector. These include a supply chain attack on Ledger that cost more than $100 million, a $116 million Coldcard exploit and a data breach at Trezor in August — a run of incidents that has intensified scrutiny of wallet security, whether hardware or software.
Zach Herbert, founder of Foundation wallet, said he largely agrees with the view that hardware wallets are dead, but argued the answer lies in an ultra-secure, open-architecture hardware security platform.
Key points
- Keystone confirmed a breach compromising customer shipping addresses but did not disclose the number of affected users.
- The company said the vulnerability has been fixed and apologized for failing to keep customer details safe.
- Crypto-related physical attacks have hit 122 in 2026, with losses estimated at over $100 million, a threat partly amplified by data breaches of this kind.
