Keystone Hardware Wallet disclosed that its website was accessed without authorization on October 20, exposing customer names, contact details, shipping addresses and order details, including items purchased and prices.
The company said it detected the unauthorized access on October 20 and confirmed on October 23, after verifying API activity with Shopify, that a third party had obtained customer shipping information.
In a statement posted to social media, Keystone apologized to customers for the exposure of details they had entrusted to the company.
What was not affected
According to Keystone, payment card and bank details, recovery phrases, private keys and wallet passwords were not compromised in the incident.
Response and customer warnings
The company said it had blocked access, patched the vulnerability, opened an investigation and was notifying affected customers by email. It added that it is conducting a thorough investigation and plans to release a detailed report in the coming days.
Keystone warned that scammers could try to exploit the incident by posing as Keystone representatives and offering refunds, replacement devices or help with orders and shipping addresses. The company urged customers to:
- Avoid unexpected links
- Never disclose recovery phrases or private keys
- Never enter a recovery phrase into a device they did not order
Background on Keystone
Keystone is best known for fully air-gapped, QR-code-based transaction signing, which keeps private keys offline without relying on USB, Bluetooth or Wi-Fi. The Hong Kong-based self-custody hardware wallet brand has expanded from its Bitcoin-focused origins into a multichain wallet supporting Ethereum, EVM assets, Solana, Polkadot, Cosmos and other networks through integrations with software wallets including MetaMask, Solflare, Keplr, Rabby and OKX Wallet.
Other hardware wallet incidents
Trezor and Ledger have also dealt with security incidents affecting their customers. In August, Trezor disclosed a customer data breach at its logistics provider ShipMonk, while Ledger confirmed earlier this month that criminals had modified genuine hardware wallets to steal recovery phrases and resold them through Southeast Asian resellers.
