Keystone Breach: Customers Say Data From Orders Older Than 180 Days Was Exposed Despite Deletion Promise

25 Oct 2026

25 Oct 2026, 17:09 UTC+01:00

Exchanges TradeReviewed News Desk

A new twist in the Keystone data leak

Hardware wallet maker Keystone confirmed this weekend that a third party obtained customer shipping information from its Shopify-powered online store. Now, according to The Block, some customers say the leak included data from orders that should already have been deleted under the company’s own privacy promise.

Keystone says it detected unauthorized access to its website on October 20 and confirmed on October 23, after checking API activity with Shopify, that names, contact details, shipping addresses and order details were taken. Payment cards, bank details, recovery phrases, private keys and wallet passwords were not exposed, the company says. It has not disclosed how many customers were affected or how the attacker got in, and says a detailed report will follow.

The 180-day promise

Keystone has used data retention as a selling point. On January 5, the day Ledger customers learned of a leak at its e-commerce partner Global-e, Keystone posted that shipping data is “permanently deleted” 180 days after an order. Its Privacy Promise page repeats that rule.

The fine print is less absolute. The Block notes that Keystone’s privacy policy, last updated in May 2021, says it erases order information for customers who have not ordered within the last 180 days. A help center article adds that city and country records are kept and that final deletion is handled by Shopify.

What customers are reporting

One X user said they bought a device more than two years ago and still received a breach notification email. Another said 214 days had passed since their last order. A third user said a caller spoofing a Montreal police number tried to social-engineer them with details matching a Keystone order from 2024, before Keystone had announced anything. The Block says it could not verify these claims, and Keystone has not publicly addressed whether it followed its 180-day policy.

Part of a wider wave

Keystone is not alone. In August, Trezor disclosed a breach at shipping partner ShipMonk, and SafePal reported a flaw in its order-tracking system. Earlier this month, Ledger confirmed tampered devices sold by reseller CryptoBilis, with onchain researchers estimating losses above $86 million, according to The Block.

What it means for traders

• If you ever ordered from Keystone, assume your name and address may be in the leaked data, even if your order is old.
• Expect targeted phishing by phone, text, email and post. Keystone says it will never offer refunds or replacement devices this way.
• Never enter your recovery phrase into a device you did not order yourself, and never follow links in unsolicited messages.
• Buy hardware wallets only from the maker or authorised resellers, and consider a delivery address that does not reveal where you live.

Hardware wallets protect keys, not your identity. For the funds you keep on exchanges, check security and licensing in our exchange comparison, see how we test exchanges, or read our BingX review. This article is for information only and is not financial advice.

Related reviews

• Bingx review
• Okx review

Sources

• The Block: Keystone customers say breach exposed data the hardware wallet maker promised to delete

News is for information only and is not financial advice. More crypto news