Keystone says website breach exposed hardware wallet buyers’ addresses

Crypto hardware wallet manufacturer Keystone disclosed a website security breach, revealing customer information to cybercriminals. The incident occurred after the company detected suspicious API activity with Shopify earlier in the week and confirmed the breach Friday. The unauthorized third party accessed customer shipping information, including names, contact details, addresses, and order specifics.

Keystone blocked access, fixed the vulnerability, and initiated an investigation, notifying affected customers via email. The company warned that exposed data could facilitate targeted phishing attacks and physical assaults. Security researcher Taylor Monahan also expressed concerns about the potential for physical attacks and kidnappings due to leaked shipping addresses.

Keystone has recorded 52 verified "wrench attacks" worldwide in the first half of 2026, a 33% increase from 39 in the same period last year. These crimes involve physical threats or violence to force cryptocurrency holders to hand over their assets. The company did not disclose the number of impacted customers. The breach has also raised questions about Keystone's retention policy for older customer data.

Despite Keystone stating a reduction in customer data retention to 180 days in 2023 following security incidents, some customers received breach notifications despite purchasing their devices over two years ago. This has raised concerns about whether older order records were retained and if the notifications imply older information was not deleted as promised.