EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar25 Oct 2026
Hardware wallet maker Keystone says a third party obtained customer shipping data after unauthorized access to its website on October 20. Recovery phrases, private keys and payment details were not exposed, but names, contact details and home addresses were, so targeted phishing and fake replacement devices are the main risk now.
Exchanges TradeReviewed News Desk
What Keystone disclosed
Keystone, the hardware wallet provider that supports Bitcoin, Ethereum, Solana, Dogecoin and other coins, publicly apologized to customers in a post on X after detecting unauthorized access to its official website on October 20, 2026. According to U.Today, Keystone confirmed on October 23, after reviewing API activity with its Shopify store, that a third party had obtained customer shipping information.
“You trusted us with those details, and we’re sorry we didn’t keep them safe,” the company wrote.
What was exposed and what was not
The leaked data includes customer names, contact details, shipping addresses and order details such as items bought and prices paid. Keystone says payment card and bank details, wallet recovery phrases, private keys and wallet passwords were not part of the incident. In other words, funds stored on Keystone devices are not directly at risk from this leak.
The company says it has blocked the access, fixed the vulnerability, started an investigation and is emailing affected customers. A more detailed report is promised.
Why a “harmless” address leak still matters
The real danger is what comes next. Keystone warned that scammers may pose as the company by phone, text, email or even regular mail, offering refunds, replacement devices or “fixes” for orders and addresses. Its message was blunt: none of it comes from Keystone.
Dogecoin community member Mishaboar echoed the warning, telling holders to expect targeted phishing emails, texts, calls and possibly physical mail, noting that this has already happened to Trezor and Ledger customers in past leaks. A shipping address can now link a person’s home to the fact that they own crypto, which also raises physical security concerns.
What it means for traders
- Never type your recovery phrase into any website, app or device you did not order yourself. No wallet maker will ever ask for it.
- Treat any unexpected “replacement device” in the mail as hostile. Do not set it up.
- Ignore links in unsolicited messages and reach support only through the official site you type in yourself.
- Share less about your holdings and family on social media, especially if you bought from Keystone.
- Keep only what you actively trade on an exchange, and choose platforms with strong security track records. Our exchange comparison and testing method explain how we rate them, with BingX and OKX currently top of our rankings.
This is not financial advice.
Sources
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.