Keystone confirms data breach: “We owe you an apology”

Hardware wallet maker Keystone disclosed on Saturday that its own web shop had been broken into. Names, contact details, delivery addresses and order details of customers were taken. Recovery phrases, private keys and payment data are not affected, according to the company. If you bought from Keystone, that means your balance is not at risk from this incident, but your address and the fact that you own a hardware wallet very much are.

That distinction is important, and it decides what makes sense now and what will land you in more trouble. The most dangerous response to a notice like this is a hasty one. Anyone who panics and resets their device, moves coins somewhere unfamiliar or goes along with a supposed replacement programme does not lose their money to the original breach in the end. They lose it to the wave of fraud that follows.

What Keystone disclosed: access on 20 October, confirmation on the 23rd

Keystone noticed the unauthorised access to its company website on 20 October 2026, by its own account. After reviewing API activity at Shopify, the maker's shop provider, the company confirmed on 23 October that a third party had obtained customer shipping data. Keystone made the incident public on 24 October through its channel on X.

The post opens with a sentence companies rarely put so plainly after a data breach: "We owe you an apology". Keystone goes on to say it has blocked the access, closed the exploited vulnerability, launched an investigation and begun notifying affected customers by email. A detailed report has been announced.

Several central details are still missing. Keystone names neither the number of customers affected, nor the period the stolen orders come from, nor the route the attacker took in. There is no country breakdown either, and therefore no answer to how many European buyers sit in the data set. Anyone wanting to know whether they are included depends for now on the company's notification. The maker's statement is the only primary source on any of this.

This data was taken, and this was not, according to the company

On Keystone's account, the data set covers names, contact details, delivery addresses and order details, meaning the items purchased and the prices paid. That last part is not a side issue: the model ordered reveals which device someone uses, and the price reveals how much they invested.

Explicitly not affected, the maker says, are credit card and bank data, recovery phrases, private keys and device passwords. That statement comes from the company itself and has not been independently verified so far; Keystone has not produced a third-party forensic report.

The claim is nonetheless technically plausible, for a straightforward reason.

The recovery phrase still only lives on the device

A hardware wallet is a device that generates and stores your private keys without ever handing them to a computer or to the network. A transfer is signed on the device itself, and only the finished signature leaves it. The maker learns nothing about your keys because it never receives them. How that works in detail is set out in our explainer on what a hardware wallet actually does.

What a web shop knows about the device

A maker's web shop is completely separate from that machinery. It processes orders, meaning address, item, price and shipping status. Between the shop system and the chip in the device there is no connection an attacker could use to reach keys from a customer database. Hence the principle that should govern every response to this incident: a data breach at the retailer is a privacy incident, not a wallet incident. You do not need to reset your device, create a new wallet or move any balance.

The Shopify API: what the reference says and what it does not

Keystone cites the review of API activity at Shopify as the route by which the scope of the breach was established. That reference is easily misread. It says the shop platform's logs showed which data was retrieved. It does not say that the Shopify platform itself was compromised, and Keystone makes no such claim.

An interface through which a shop system hands out order data is an ordinary tool for the operator. It is secured with access keys and often opened up to add-on apps that handle shipping, marketing or accounting. Where such a key falls into the wrong hands, or a connected add-on is itself attacked, the records can be drained without anyone breaking into the shop. Which of those routes was taken here, Keystone has not yet said.

The four scams Keystone itself warns about

The maker sets out fairly precisely what those affected now have to expect. Criminals pose as Keystone, by email, phone, text message or post. What they offer is refunds, free replacement devices and help with a supposedly faulty order or delivery address. The company states clearly that it never asks for a recovery phrase or a private key.

The most dangerous of these is the replacement device. The scam works because it looks like goodwill: a parcel arrives containing a device and a note saying the old model was affected by the incident and the new one is already set up. Anyone who uses the enclosed recovery phrase, or enters their own into an unfamiliar device, hands over control of their balance. That is why the rule holds without exception: a recovery phrase never goes into a device you did not order yourself, and never into a website or a form. We collected the typical warning signs in such messages after earlier cases, in the overview of phishing after a data breach.

The inclusion of post in that list is what separates this from an ordinary email leak. A letter with the correct address, the right order date and the matching model name feels real because it looks real. The details that make it credible come from the data set.

The delivery address is the real damage

An email address can be changed. A home address cannot, at least not without moving. That is why security specialists speak more bluntly about leaks at mail-order sellers of crypto devices than about other data breaches.

Security developer Taylor Monahan, known in the industry as Tay, has pointed out, according to reports by crypto.news, that shipping data of this kind can expose buyers to physical threats, up to robbery and kidnapping. The industry term for this is a wrench attack: an attack that does not go after the encryption at all, but after the person who knows the key. There is no evidence so far that the data stolen from Keystone has already led to physical attacks.

The sober assessment: the data set contains one piece of information that an address list from any other online shop does not. It links an address to the statement that someone living there holds crypto assets in self-custody and spent money doing so. Anyone who has had devices delivered to their home address has a reason, after this incident, to handle that differently in future, via a parcel locker or a delivery address that is not the home. For choosing a device, that is now a criterion alongside the technical ones: our hardware wallet comparison sets out which makers ship by which routes.

The 180-day promise and the privacy policy of 7 July

How large the damage is depends on how long Keystone keeps order data at all. There are two public statements from the company on this, and they do not match.

German specialist outlet block-builders.de pointed out that Keystone advertised on X on 5 January 2026 that shipping data is permanently deleted 180 days after an order. The company's privacy policy puts it more narrowly. There it says the order information of every customer who has not placed an order within the last 180 days is deleted. On that wording the period runs from each customer's most recent order, not from every individual one. For anyone who bought twice, the older order therefore stays stored. Cryptoticker.io carried out this review itself on 25 October 2026, on the basis of the privacy policy dated 7 July 2026 on the company's site.

Whether the data set really contains only orders from the last 180 days is therefore open. Keystone has not committed itself on the point when asked on social media, pointing instead to the running investigation and the announced report. Whether the January pledge was kept cannot be established as things stand, and no such assessment is made here.

Yanssie HK Limited in Hong Kong: who stands behind the brand

For European buyers, one entry in that same privacy policy matters more in practice than the deletion period. It names Yanssie HK Limited, based in Hong Kong, as the responsible company, and submits to the law of the Hong Kong special administrative region.

The General Data Protection Regulation applies regardless where a provider outside the EU deliberately sells goods to people in the Union. Article 27 additionally requires such providers to designate a representative in the Union whom data subjects and supervisory authorities can approach. Keystone's privacy policy names no such representative. As the route for access, rectification and erasure it gives the company's support address, along with a note that you can turn to the data protection authority in your country.

In practice: your rights exist, but the path to them is longer than with a provider that has an establishment in the EU. Anyone who wants to avoid that cannot dodge the basic question of how much to hold themselves and how much to leave with a supervised provider. Which houses operate under supervision is shown in the overview of regulated crypto exchanges.

Access under Article 15, compensation under Article 82

Two claims matter for those affected in Europe. Article 15 of the General Data Protection Regulation gives you the right to learn what data a company holds about you. In this incident that is the only reliable way to settle the question Keystone left open: which period your orders still cover, and what of that sat in the data set. The request goes to the company's support address, it needs no particular form and it is free.

Article 82 governs compensation. Germany's Federal Court of Justice ruled on 18 November 2024, in the proceedings on the data breach at the social network Facebook, case number VI ZR 10/24, that the mere loss of control over one's own data can constitute non-material damage. Under the headnotes, neither a misuse of the data need have occurred nor must further tangible adverse consequences be added. Those proceedings concerned a data set of 533 million entries worldwide, including around six million people in Germany.

On the amount the judgment says little that generalises. What counts under the case law includes the sensitivity of the data concerned, the nature and duration of the loss of control, and whether control can be regained. There are no reliable figures for a case like this one, and anyone who quotes you a sum before the scope and period of the breach are settled is working with a number nobody yet knows. That a claim exists in principle is, after the Federal Court of Justice decision, no longer the contested question it was before 2024.

Trezor, SafePal, Ledger: the shipping route is the weakest link

The case joins a run that has become conspicuously dense in 2026, and the pattern is the same every time: every time the cryptography of the devices holds, and every time the chain of shop system, logistics provider and connected add-ons gives way.

Trezor reported a breach via logistics provider ShipMonk in August, initially covering 13,689 customers; in early September the company said around 67,000 further US customers with orders from the years 2019 to 2021 were added. What those affected could do is written up in our piece on the Trezor data breach. SafePal named 39,798 affected customers in the same month, taken via an embedded shipment-tracking add-on. The oldest and best known case remains Ledger: after the 2020 incident, around 272,853 records with addresses became public, along with some one million email addresses.

The Trezor follow-up disclosure in September shows exactly the problem now hanging over Keystone: orders from 2019 to 2021 sat in a data set there, although the provider had previously confirmed in writing that old data had been deleted. A promised deletion period is worth only as much as its implementation at every provider that ever saw the data.

For the trade-off between self-custody and third-party custody, that changes little. Key sovereignty remains the strongest argument for owning a device, and none of these incidents has ever led to a loss of balance through the device itself. What changes is the realisation that buying a security device itself leaves a data trail you have to factor in.

Keystone data breach: the seed is safe, the delivery address is not

For owners of a Keystone device, a manageable order of business follows.

1. Change nothing on the device. No reset, no new recovery phrase, no moving of the balance. The incident concerns the shop system, not the keys. If you are thinking about changing devices anyway, the hardware wallet comparison is the place for that, not an email offering you a replacement.
2. Treat every approach as fake until the opposite is established. Click no links from messages, use no callback numbers from emails, enter no recovery phrase. Reach the maker through its website address typed in yourself. If you want to hold less yourself as a matter of principle, check the supervised providers in the overview of regulated crypto exchanges instead.
3. Request access under Article 15 and wait for the report. An informal email to support settles which order data is still stored. Wait for the company's announced detailed report before you consider going further. If you are also weighing whether to keep smaller amounts off a device entirely, the alternatives are in the software wallet comparison.

The one figure still missing from this incident is the number of people affected. Until Keystone names it, every buyer has to assume they are among them.

(As of October 25, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)