2026 Keystone Hardware Wallet — website accessed without authorisation; customer names, shipping addresses and order details exposed
Data compromised
Names, contact information, shipping addresses, and order records including items bought and prices paid (one outlet also reports email addresses and phone numbers). Keystone says card and bank details, recovery phrases, private keys and wallet passwords were not compromised. The number of affected buyers has not been disclosed.
Technical writeup
Company statement reported by Bitcoin.com, CoinSpectator and others (Oct 24, 2026); the statement itself was posted on X and was not accessible to us, and keystone.com does not carry a notice. Keystone says it cut off the access, fixed the flaw, opened an investigation and began emailing affected customers, and promised a fuller report. Scammers may impersonate Keystone staff with refund, replacement-device or order-help offers. The company has not disclosed how many buyers were affected. A 2026 incident at Trezor’s shipping provider is a similar pattern. recordsAffected 0 (count not disclosed).
Root cause
Unauthorised access to the Keystone online store, identified on Oct 20, 2026. Coverage says the company confirmed on Oct 23, after reviewing Shopify API activity, that customer shipping data had been taken. The access route has not been described.