Keystone hardware wallet website hit by unauthorized access, user names and shipping addresses leaked

Source: PANews2026/10/25 03:23

Analysis

The breach at Keystone is a supply-chain-adjacent data exposure rather than a compromise of key material, since only names, contact details, shipping addresses and order records were obtained through Shopify API activity, while seed phrases and private keys remained untouched. The practical risk shifts to targeted phishing and physical-security threats, because attackers now hold verified purchase histories that let them impersonate refund or device-replacement offers convincingly. Keystone's four-day gap between detecting the intrusion on October 20 and confirming the data theft on October 23 will likely draw scrutiny over disclosure speed. Worth watching next: whether Shopify attributes the API access to a specific integration or credential leak, whether affected users report credible impersonation attempts, and whether other hardware wallet vendors tighten third-party e-commerce permissions in response.

If you have any feedback or questions about this content, please contact us at crypto.news@kcex.com

PANews, October 25: Keystone, a hardware wallet maker, said in a post on X that it detected unauthorized access to its official website on October 20, and after verifying API activity with Shopify, confirmed on October 23 that a third party had obtained customer shipping information. The leaked data includes names, contact information, shipping addresses and order details (products and prices); payment card or bank information, recovery phrases, private keys and wallet passwords were not compromised. Keystone said it has blocked the access, patched the vulnerability and launched an investigation, and is notifying affected users by email. It also warned users to be alert to scammers impersonating Keystone via phone calls, text messages, emails or letters under the pretext of refunds or device replacements, and never to provide recovery phrases or private keys to anyone.

Disclaimer: The articles reposted on this website are sourced from public platforms and are for reference only. These articles do not represent the views or opinions of KCEX. All copyrights belong to the original authors. If you believe that any reposted article infringes upon the rights of a third party, please contact crypto.news@kcex.com for removal. KCEX makes no representations or warranties regarding the timeliness, accuracy, or completeness of reposted articles, and shall not be liable for any actions or decisions made based on such content. Reposted materials are for informational purposes only and do not constitute advice, endorsement, or basis for any commercial, financial, legal, and/or tax decisions.