Keystone wallet data breach

[Ashawowo(OS)]

As posted on their X handle, their official website experienced an unauthorized access on Oct 20th which led to the data breach.

We owe you an apology.

On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.

Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.

We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.

Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.

NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.

A detailed report is coming soon.

Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance.

Again, we're truly sorry to everyone affected.

https://x.com/KeystoneWallet/status/2114054080754770137

Full incident breakdown of the 25,964 affected buyer records here

[nikola22]

We owe you an apology.

once again the company is offering nothing more than apologies to its customers. companies that manufacture devices intended to secure clients' assets are unable to ensure the safety of their own data. kind of a paradox, isn't it?

[Bitcoin_Arena]

Do these people ever even learn from the past events? 

Alright, we know the drill after the information leaks. The customers are going to receive phishing emails or even fake devices on their doorsteps. Worse still, given their addresses are exposed, the people with bad intentions now know they hold some crypto, and in most cases, a sizable amount. They are literary moving banks. What stops robbers from showing up at their addresses, probably with some guns?

[Charles-Tim]

Someone was few minutes earlier in posting about Keystone data breach. Although, it was posted in bitcoin discussion board.

Here is it: What do you think about this user data leak from the famous keystone company

I still think a single thread will be better for the kKeystone data breach.

Data breach is not something new to hardware wallets companies anymore. If you are buying from any hardware wallet company, just know you may not have privacy.

[BitMaxz]

Another hardware wallet with a data breach and an apology? It seems they aren't seriously protecting those important data; it's similar to what happens in other hardware wallets.
What's next? It might be similar to other hardware wallets and end up being compromised, also the private keys and seed.
I lost trust in any hardware wallet nowadays; there's no safe anymore. Like I said before, there's no perfect security; hackers always come up with new plans and develop new exploits that can wreck hardware wallets.

I suggest to those who have hardware wallets like this one better move their funds immediately to another wallet installed in cold storage, which is way safer from online attacks. I no longer know which hardware wallet is safe; closed/open-source, they both can be breached.

Luckily this is only from a database from their website that handles customers' data, but it is still alarming because they can't handle the security from their website.

[PX-Z]

I cant really tell why the hell they keep the address and mobile number on their database or say those info, although they can encrypt it if they want to save it but how those companies don't ever learn that might someday be hack. Are they that really confident or they just stupid. And now saying sorry feels like they can solve those problem with data already exposed.

[DaveF]

You know, at this point I think I'm just going to order my hardware wallets from Amazon. At least I'll get free two day shipping with my Prime membership. Seriously, I understand with everything going on and all the vulnerabilities popping up day after day that these things are going to happen. But, at what point do you take a giant step back from the way you're doing things on your website in terms of sales end just slam every vulnerability scanner you could find against it and see if anything is not setup properly.

-Dave

[m2017]

You know, at this point I think I'm just going to order my hardware wallets from Amazon. At least I'll get free two day shipping with my Prime membership.

And how exactly will this protect your personal data from being leaked? Don’t Amazon (along with their delivery couriers) already have access to your name, shipping address, phone number, and payment details? Or do you somehow believe that Amazon is invulnerable?

Seriously, I understand with everything going on and all the vulnerabilities popping up day after day that these things are going to happen. But, at what point do you take a giant step back from the way you're doing things on your website in terms of sales end just slam every vulnerability scanner you could find against it and see if anything is not setup properly.

-Dave

All that’s really needed is to change the order-processing policy used by HW-manufacturers. This means either eliminating the requirement to provide personal data entirely, or limiting the retention period for such information to just a few hours or days (only as long as is strictly necessary to complete an order). For example, one could provide a unique verification code (issued when placing an order) upon receipt of a parcel. But would delivery services agree to this? After all, it would require changing their entire established system.

I fear I might be misunderstood if I say that the numerous data breaches already experienced by various HW-manufacturers are actually a good thing. Yet, it is only through such "shock therapy" that the industry will begin to grasp the risks (including the risks to its own reputation) and start making changes (hopefully for the better, from the customer's perspective) regarding how personal data is collected and stored, and how parcels are delivered.

There is no progress when everything is going smoothly. It is only negative events that push an industry toward change and evolution.

[Pmalek]

Another day and another data leak.
I am curious to see what their report will say. They are still investigating the scope of the hack. Keystone claims that user data is deleted 180 days after an order. This hack will prove if that's true or not. If they are honest about the findings, of course. What do you guys think? Will we find out that they have been storing data for much longer periods of time and it's all now in the hands of scammers and hackers?

You know, at this point I think I'm just going to order my hardware wallets from Amazon.

I hear that's very safe. There is a big group of Ledger customers who have bought their hardware wallets from official resellers in Asia and Europe and are extremely pleased about how that went. Data leaks suck and are awful. It's even worse waking up one day and seeing that your balance went to zero overnight.

[DaveF]

You know, at this point I think I'm just going to order my hardware wallets from Amazon. At least I'll get free two day shipping with my Prime membership.

And how exactly will this protect your personal data from being leaked? Don’t Amazon (along with their delivery couriers) already have access to your name, shipping address, phone number, and payment details? Or do you somehow believe that Amazon is invulnerable?

I think you I can get an amazon gift card from a bunch of places or a virtual Visa or MC gift card and a disposable email address.
Then you get the free prime for 30 days offer.
Then you order whatever you want to an Amazon locker.

Even if Amazon does get hacked and everything fully out there, what exactly are they going to get from that info.

-Dave

[crwth]

Aren't these problems caused by tampering? I think things like fake unit replacements or plain tampering have happened, like the recent issue with Ledger resellers.

Right now, what matters is making sure there's a check to confirm no tampering has happened.

The sellers should be accountable for those problematic leaks, and customer privacy should be prioritized.

[Lucius]

Another day and another data leak.
I am curious to see what their report will say. They are still investigating the scope of the hack. Keystone claims that user data is deleted 180 days after an order. This hack will prove if that's true or not. If they are honest about the findings, of course. What do you guys think? Will we find out that they have been storing data for much longer periods of time and it's all now in the hands of scammers and hackers?
~snip~

Considering how valuable data is today, I wonder if anyone deletes it at any point in time. What is not at all clear to me is the way in which these data are stored, because instead of being encrypted and stored offline, they are kept practically at the fingertips of any hacker with a little skill. Things like this have been happening for years and no one has learned anything from it.

[ryzaadit]

My last Keystone discussion was 9-10 days ago on thread A good move or stupid idea?. Someone got a phising/malware emails in his inbox about his Keystone device. Since he sharing the emails on that thread and we can't find any of those blogs or information, starting to ask.

Can't find the article. It's these the blogs/information are being sent specifiq only for you as custome? they not make these public yet?

Then, I ask the official.

-snip-

However, with these scam attempts, it leaves me with some questions. OP, did you really have a Keystone Hardware Wallet? If yes, how the one who tried phising you knowing you have Keystone Hardware Wallet. Leave me with 2 scenario:

• Keystone Hardware Wallet database for their customer is being leaked.
• Or you already leaked your self.

The phising knowing you own Keystone Hardware Wallet. Suggestion for OP, you already being on target list for Phissing/Malware/Sam with topic Keystone Hardware Wallet. Just my suggestion for you, for now never taking any information for wallet, hardware wallet from your emails.

Now that this breach happened, did anyone believe this breach actually already happened even before 20 October? cause the phishing emails started almost 2 weeks ago before this breach. Is this the first breach by Keystone?

[Pmalek]

Now that this breach happened, did anyone believe this breach actually already happened even before 20 October?

In their statement Keystone says that they detected unauthorized access to their website on 20 October. That doesn't mean that the breech also happened on that day. That's only when they noticed it. The unauthorized access could have happened days or weeks before them noticing it. The phishing email you received could be proof of that but it can also be unrelated. If that email access of yours got exposed in a past data leak, you might have received the Keystone phishing email by chance. One of my email addresses gets phishing emails for Coinbase, Binance, various casinos and giveaways even if I don't use those services. The data leaked once and now various parties use it in their phishing campaigns.

[Bitcoin_Arena]

You know, at this point I think I'm just going to order my hardware wallets from Amazon. At least I'll get free two day shipping with my Prime membership. Seriously, I understand with everything going on and all the vulnerabilities popping up day after day that these things are going to happen. But, at what point do you take a giant step back from the way you're doing things on your website in terms of sales end just slam every vulnerability scanner you could find against it and see if anything is not setup properly.

-Dave

You might dodge the bullet of data leaks, but then how about the resellers compromising the devices? I think that is an even equally bad decision, especially if you plan to keep your life savings in such wallets

With the hackers lurking everywhere after being hyped up by AI, using third parties in any form just seems unsafe.

[X-ray]

Now that this breach happened, did anyone believe this breach actually already happened even before 20 October?

In their statement Keystone says that they detected unauthorized access to their website on 20 October. That doesn't mean that the breech also happened on that day. That's only when they noticed it. The unauthorized access could have happened days or weeks before them noticing it. The phishing email you received could be proof of that but it can also be unrelated. If that email access of yours got exposed in a past data leak, you might have received the Keystone phishing email by chance. One of my email addresses gets phishing emails for Coinbase, Binance, various casinos and giveaways even if I don't use those services. The data leaked once and now various parties use it in their phishing campaigns.

Agreed, basically once the email got exposed, any kind of phishing attempt will come through so there's no guarantee that specific email is because of the leak. Those scammers really like to brute sending emails to their mailing list database.

I even got handful of phishing emails from exchange that I never even signed up in.

We owe you an apology.

once again the company is offering nothing more than apologies to its customers. companies that manufacture devices intended to secure clients' assets are unable to ensure the safety of their own data. kind of a paradox, isn't it?

When you run a hardware wallet company and see competitor getting breached or even going as far as getting tampered yet there's no meaningful backlash nor meaningful legal escalation, the best thing you could do to save your business is to issue apology and forget it .

[SFR10]

Keystone claims that user data is deleted 180 days after an order. This hack will prove if that's true or not. If they are honest about the findings, of course. What do you guys think? Will we find out that they have been storing data for much longer periods of time and it's all now in the hands of scammers and hackers?

There's no way for me to tell what I'm about to point to is true or not... However, there's a user who claims he/she ordered 214 days before the data breach and still received an email from Keystone that says he/she is affected ^[source] and there's another user who claims to be a former employee of Keystone and it says the 180-day claim is false ^[source].

[Wind_FURY]

We owe you an apology.

once again the company is offering nothing more than apologies to its customers. companies that manufacture devices intended to secure clients' assets are unable to ensure the safety of their own data. kind of a paradox, isn't it?

It's laughable because owning a hardware wallet today has put the owner in a higher probability of getting into danger than putting him/her in a safer situation.

   ¯\_(ツ)_/¯

There are also software vulnerabilities being discovered in a faster rate because of A.I.

The next Black Swan might be caused by a serious system/network vulnerability.

[Ashawowo(OS)]

The data leak dates back to 2024 and according to them, the manual deleting process from Shopify backend delayed data to be erased for 2 years. This proves them very inefficient in managing data since they were not enforcing their data erasing policy on relevant third-parties before now. The truth is that even though Shopify gives their word that the data was erased, it could still be retained and we'll only hear of it in the next data breach.

Incident Overview
On October 20, 2026, our security monitoring systems detected unusual access to the official website. We immediately disabled sensitive website functions that could potentially expose users to attacks and blocked the relevant unauthorized access points on the same day. We also fixed the vulnerability and launched a forensic investigation and additional security measures.
Our investigation found that the attacker exploited a vulnerability in a third-party data monitoring tool used by our website to escalate privileges. This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices.
2. Scope of Impact
(1) Affected buyer records: 25,964
Our investigation found that the incident involved 51,083 buyer records generated by purchases made through the Shopify store on our official website. These records were stored and managed by Shopify. Customer purchase information from Amazon and channels was not affected.
Of these records, the personal information associated with 25,119 had already been permanently erased from Shopify before the unauthorized access, in accordance with our data retention policy. The associated order information had been anonymized and no longer contained personally identifiable information such as names, contact details, or shipping addresses.
The remaining 25,964 records still contained personal information, covering the period from 2024 to 2026. This information included names, contact details, shipping addresses, and order information.
Under our data retention policy, buyer records should be erased after 180 days. Because erasure through the Shopify backend requires manual processing of individual records, which is inefficient, we developed an automated tool to handle bulk erasure. However, the tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period.
This exposed shortcomings in the design and operational monitoring of our data processing procedures. We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.
Progress on erasing overdue data: We have improved our erasure procedures and, on October 24, 2026, submitted requests to Shopify to erase all buyer personal data that had exceeded the 90-day retention period. Under Shopify's rules, the requests require a 10-day waiting period before the erasure is finalized, meaning completion is expected on November 3, 2026. We will update this announcement with the results once the erasure is complete.

https://x.com/KeystoneWallet/status/2114719318722404578

[nikola22]

The data leak dates back to 2024 and according to them, the manual deleting process from Shopify backend delayed data to be erased for 2 years. This proves them very inefficient in managing data since they were not enforcing their data erasing policy on relevant third-parties before now. The truth is that even though Shopify gives their word that the data was erased, it could still be retained and we'll only hear of it in the next data breach.

as for me, the most important that the attacker obtained the WebAuth key used to verify whether a device is genuine through device authentication page: https://keyst.one/authentication/  this key is burned into the devices and can't be replaced. if it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks. so Keystone has to detroy 18 835 devices in their inventory. they promise that all newly manufactured devices will use a new authentication key. now shipping of all unshipped orders from their official website has been suspended.

so the problem lies not only in the loss of customer data but also in the loss of the device verification key. Keystone says that devices delivered before October 20, 2026 are unaffected and their authentication can be considered genuine. devices received after October 20, 2026 that use the old authentication key could be counterfeit.