Hackers took Keystone buyers’ addresses from its Shopify store

Hardware wallet maker Keystone said an intruder broke into its Shopify-powered online store and walked off with customer names, contact details, shipping addresses and order records, though not payment data, recovery phrases or private keys.

Breach spotted October 20, confirmed October 23

The Hong Kong-based firm apologized on X on Saturday, October 24, saying it spotted unauthorized access to its official website on Oct. 20 and, after checking API activity with Shopify, confirmed on Oct. 23 that a third party had obtained customer shipping data.

“You trusted us with those details, and we’re sorry we didn’t keep them safe,” Keystone wrote.

The stolen records cover names, contact details, addresses and order information such as items bought and what they cost, while recovery phrases, private keys, wallet passwords and card and bank details stayed out of reach, Keystone said.

The company said it had shut off access, patched the vulnerability, launched an investigation and begun emailing affected customers. It has given no victim count, no entry point and no word on the attacker, though it said a detailed report is coming soon.

Keystone warned buyers that imposters could call, text, email or mail them with offers of refunds, new devices or “fixes” for an order or address. It also told buyers not to enter a recovery phrase on a device they hadn’t ordered and to type the keyst.one address themselves.

Before Keystone went public, X user @PEPE_Whale69 reported a possible leak on Friday evening. They said they got a call from someone spoofing a Montreal police number, who asked if Amazon, eBay or Keystone meant anything.

The post said that the details of the caller tallied with the user’s 2024 Keystone order. Keystone responded at 1:08 a.m. ET Saturday, saying it had “initiated an urgent investigation into this matter.”

Customers say orders past 180 days leaked

Keystone has touted data deletion as a selling point. On January 5, the day that Ledger customers were notified of a leak at e-commerce partner Global-e, Keystone posted that “180 days after your order, your shipping data is permanently deleted.”

“Other hardware wallets keep your data forever. We delete your shipping info in 180 days max,” Keystone wrote in March.

On Saturday, @trintaetres_33 said the breach email reached them even though they bought a device more than two years ago. @BlockchainBarmy said that 214 days had passed between their last order and the breach.

The 2024 order linked to the spoofed call is also more than 180 days old, but Keystone hasn’t said in public if it followed its own policy, and none of the customer claims have been checked out.

On its Privacy Promise page, Keystone says that all shipping information is deleted automatically 180 days after an order. But in its privacy policy, which was last changed in May 2021, it says that order data is deleted only for customers who haven’t placed an order in the last 180 days.

A help center article says that records of the city and country are kept even when buyers ask for deletion, and that Shopify does the final deletion.

In August, Trezor said a breach at shipping partner ShipMonk exposed nearly 14,000 customers, and it later added roughly 67,000 more U.S. customers to the tally.

A few days after Trezor’s first disclosure, SafePal said that a bug in its system for keeping track of orders had exposed almost 40,000 customers.

Cryptopolitan reported earlier this month that Ledger confirmed that hidden chips inside wallets sold by CryptoBilis were reading 24-word recovery phrases during setup and sending them out via LTE. On-chain researchers put the losses at more than $86 million.

Because of this, Trezor will stop selling to some resellers from January 1, 2027.

Keystone wallets use QR codes to sign transactions, so they don’t need a USB, Bluetooth or Wi-Fi connection. The hack affected the company’s Shopify store.