---
title: Hardware wallet maker Keystone confirms a third party took customer names, contact details and shipping addresses from its Shopify store | ctxsec
url: https://ctxsec.com/items/keystone-hardware-wallet-shopify-shipping-data-breach
description: ""
status: "confirmed (Keystone official statement on X, Oct 24); number of customers affected not yet disclosed; full report promised, last updated Oct 26, 2026, 4:05 PM ET"
published: 2026-10-24
updated: 2026-10-26T16:05:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/keystone-hardware-wallet-shopify-shipping-data-breach.md)

confirmed (Keystone official statement on X, Oct 24); number of customers affected not yet disclosed; full report promised

2026-10-24 · updated

Oct 26, 2026, 4:05 PM ET

### Hardware wallet maker Keystone confirms a third party took customer names, contact details and shipping addresses from its Shopify store

**Update Oct 26:** Keystone says the intruder also stole its device authentication key; it will destroy 18,835 devices in inventory, and 25,964 buyer records were exposed. See [the follow-up](/items/keystone-webauth-device-key-stolen-18835-wallets-destroyed).

Keystone said on **Oct 24** that it detected unauthorized access to its official website on **Oct 20** and, after checking API activity with Shopify, confirmed on **Oct 23** that a third party obtained customer shipping information.

- **Exposed** (per Keystone): names, contact details, shipping addresses and order details.
- **Not exposed** (per Keystone): payment data, private keys and recovery phrases. The wallets themselves are offline devices.
- Keystone says it blocked the access, fixed the vulnerability and emailed affected customers. It has not said how many people are affected and says a detailed report will follow in the coming days.
- Before the disclosure, a customer posted on Oct 23 that they had received a social-engineering call from a spoofed police number, which is the typical follow-on after wallet-customer leaks like the earlier Ledger and Trezor cases.

If you bought from Keystone: expect fake support emails, texts and calls offering refunds or replacement devices. Keystone will never ask for a seed phrase.

Sources: [Keystone on X: official statement (Oct 24)](https://x.com/KeystoneWallet/status/2114054080754770137) · [Keystone on X: detailed report to follow](https://x.com/KeystoneWallet/status/2114077228132892712) · [The Defiant (Oct 24)](https://thedefiant.io/news/security/keystone-website-breach-exposes-customer-addresses-and-order-details) · [Keystone on X: Statement regarding the security incident on our official website (Oct 26)](https://x.com/KeystoneWallet/status/2114719318722404578)