Keystone Hardware Wallet Says Customer Data Breach Exposed Shipping Addresses, Purchase Records
Summary
- Keystone said unauthorized access to its online store exposed customers’ names, contact details, shipping addresses, and purchased items and pricing information.
- The incident raised questions about Keystone’s data retention policy and a possible gap between its stated 180-day data deletion practice and its actual implementation.
- It warned that similar personal data breaches at hardware wallet firms including Trezor and SafePal have heightened the risk of impersonation scams and phishing attacks.
Forecast Trend Report by Period
A security incident at cryptocurrency hardware wallet maker Keystone exposed customers’ personal information to unauthorized third parties.
The Block reported on October 25 that Keystone said on its official X account that unauthorized access to its online store exposed customers’ names, contact details, shipping addresses, purchased items and pricing information.
Keystone discovered abnormal access on its official website on October 20. On October 23, while reviewing application programming interface activity on e-commerce platform Shopify, it determined that a third party had stolen the data. The company said payment card and bank account information, wallet recovery phrases, private keys and passwords were not compromised.
The company blocked the attack route and fixed the security vulnerability. It is notifying affected customers by email. The exact number of victims and the method of attack have not yet been determined. Keystone said it plans to release a detailed incident report after further investigation.
The breach also raised questions about Keystone’s data retention policy. The company had said it permanently deletes shipping information 180 days after a product order. Some users, however, said they received breach notifications even though they had made their purchases more than two years earlier or more than 214 days had passed since their last order.
Another user said they received an impersonation call from someone who knew order details from a 2024 purchase. Those claims have not been independently verified, and Keystone has not provided a specific response on whether it followed through on its 180-day data deletion policy.
Similar security incidents have recently hit the hardware wallet industry. In August, Trezor said a data leak at a shipping partner exposed information on about 14,000 customers, and it later confirmed that about 67,000 additional U.S. customers were affected. SafePal has also said a flaw in its order lookup system exposed personal information on about 40,000 users.
Keystone warned that the exposed personal data could be used for impersonation scams and phishing attacks. It urged users to be cautious of messages citing refunds, device replacements or changes to order information, and not to click links from unclear sources or enter wallet recovery phrases.
