Saturday, October 24, 2026 --:--:-- ET
New York 62°F Partly cloudy Los Angeles 78°F Sunny Chicago 55°F Windy
Subscribe
U.S. Edition Est. 2026 Oct. 24, 2026

US News America

Independent reporting for a changing America

Breaking
Typhoon Champi Kills One and Injures More Than 500 in Taiwan as Hurricane Vance Nears Mexico Flooding on the San Juan River Forces Evacuations and Dozens of Rooftop Rescues in New Mexico Keystone Says Website Breach Exposed Customer Names, Shipping Addresses and Order Details Brent Crude Settles at $116.72, Its Highest Since April, as Houthi Strikes and a UAE Oil Spill Rattle Supply 410,000 March Across France as Saturday Protests End in Tear Gas and Arrests in Paris
Technology

Keystone Says Website Breach Exposed Customer Names, Shipping Addresses and Order Details

Keystone said unauthorized access to its website on October 20 exposed customer names, contact details, shipping addresses and order details. The company said payment details, recovery phrases and private keys were not exposed, and it warned customers about impersonation scams.

By admin Oct. 24, 2026 · 5:43 PM ET 2 min read

A small black hardware wallet device with a blank dark screen on a wooden desk next to a closed laptop.

Hardware wallet maker Keystone said on Saturday that a third party obtained customer names, contact details, shipping addresses and order details from its official website. The company detected unauthorized access on October 20 and confirmed the exposure on October 23, after checking API activity with Shopify, and disclosed it in a post on X on Saturday. Keystone said payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed.

Two hands holding a small black electronic device with a blank dark screen in front of a laptop keyboard.

The exposed records covered the products customers bought and the prices they paid, according to Keystone. The company said it has blocked the unauthorized access, fixed the vulnerability, opened an investigation and is emailing affected customers. It has not said how many customers are affected, and it promised a detailed report in the coming days.

Plain brown cardboard shipping parcels stacked on a doorstep beside a front door.

Company warns about impersonation scams

Keystone warned that scammers could pose as the company by phone, text, email or mail and offer refunds, replacement devices or fixes for an order or address. The company said it never asks for recovery phrases or private keys, and it urged customers to avoid links in unexpected messages and never to enter a recovery phrase into a device they had not ordered.

A brass padlock resting on a black computer keyboard.

The disclosure concerns the company’s website records, not the wallets themselves. Keystone is known for air-gapped transaction signing using QR codes, which keeps private keys offline without USB, Bluetooth or Wi-Fi, according to Crypto Briefing. CoinLab reported that owners’ funds were not touched because the keys live on the devices, not on the website, but a list of names, addresses and proof of a wallet purchase makes owners an attractive target for phishing and physical threats.

Other wallet makers have reported similar customer-data incidents. In August, Trezor disclosed a customer data breach at its logistics provider ShipMonk, Crypto Briefing reported, and Ledger confirmed earlier this month that criminals had modified genuine hardware wallets to steal recovery phrases and resold them through Southeast Asian resellers.

Reporting based on coverage by Crypto Briefing and CoinLab.

Related Stories