Keystone Hardware Wallet disclosed today that its website was accessed without authorization on October 20, exposing customer names, contact details, shipping addresses and order details, including items purchased and prices.
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…
— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026
The company said it confirmed on October 23, after reviewing API activity with Shopify, that a third party had obtained the information. Payment card and bank details, recovery phrases, private keys and wallet passwords were not compromised, according to Keystone.
Keystone said it had blocked access, patched the vulnerability, opened an investigation and was notifying affected customers by email. It warned that scammers could exploit the incident by posing as Keystone representatives and offering refunds, replacement devices or assistance with orders and shipping addresses.
The company urged customers to avoid unexpected links and never disclose recovery phrases or private keys or enter recovery phrases into devices they had not ordered.
Keystone said it is conducting a thorough investigation and plans to release a detailed report in the coming days.
Keystone is best known for its fully air-gapped, QR-code-based transaction signing, which keeps private keys offline without relying on USB, Bluetooth or Wi-Fi.
The Hong Kong-based self-custody hardware wallet brand has expanded from its Bitcoin-focused origins into a multichain wallet supporting Ethereum, EVM assets, Solana, Polkadot, Cosmos and other networks through integrations with software wallets including MetaMask, Solflare, Keplr, Rabby and OKX Wallet.
Trezor and Ledger have also dealt with security incidents affecting their customers.
In August, Trezor disclosed a customer data breach at its logistics provider ShipMonk, while Ledger confirmed earlier this month that criminals had modified genuine hardware wallets to steal recovery phrases and resold them through Southeast Asian resellers.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.