Keystone Wallet Breach Exposed Customer Addresses and Orders
Keystone built its name on keeping crypto keys out of reach, and on Tuesday 20 October 2026 the intruder came in through the online shop. The open question is a promise to delete customer data after 180 days.
The hardware wallet maker says it detected unauthorized access to its official website on Tuesday 20 October. On Friday 23 October, after going through API activity with its e-commerce provider Shopify, it confirmed that a third party had obtained customer shipping information. On Saturday 24 October it told the public.
What walked out of the door, according to Keystone: customer names, contact details, shipping addresses and order details, including the items bought and their prices. What did not: payment card and bank details, recovery phrases, private keys and wallet passwords. Keystone says it has blocked the access, patched the hole and started emailing affected customers. It has not said how many people are concerned or how the intruder got in, and it has promised a detailed report within days. In its post it told customers it was sorry it had not kept their details safe. Honestlu, the list of what stayed locked is the strongest part of the announcement.
Then comes the number: 180. Blockonomi reports that Keystone's privacy policy describes deleting order records after 180 days when a customer has not placed another order. The Block reports that Keystone has said it deletes customer information 180 days after orders in most cases, and that some users on X doubt it. ETHNews adds the awkward detail: nobody outside the company can say whether the exposed records fell inside that window, because no affected date range has been published. A promise to forget is the hardest one to audit, and the Spirit's long nose has never trusted one that couldn't be checked.
The stakes are practical. Glitchwire points out that a list of people known to own hardware wallets, matched to their home addresses, now sits with whoever took it. Keystone itself warned that scammers may pose as its staff and offer refunds, replacement devices or help with orders. The incident also lands after a rough summer for the category, with Ledger and Trezor each dealing with separate security incidents since then, according to Crypto Briefing and CryptoPotato. OOOOOFU.
How long does youluwu think a shop really keeps your address once the parcel has arrived? Keystone's own report, when it comes, should say whether the 180 day rule was a policy or a wish.
In this casino the house kept a guest list and promised to burn it after 180 days. Whether it did is the one card still face down.
Would you still buy a hardware wallet from Keystone?
No right answer. Just your gut, and the Spirit watching.
