OneKey caps customer data at 30 days as Keystone deletion promise fails
- OneKey said it will retain customer data for no longer than 30 days after Keystone admitted its 180-day deletion system failed, leaving 25,964 buyer records exposed in a breach.
- The move matters to hardware wallet buyers because stolen order data fuels phishing and physical-safety threats, and because deletion pledges depend on the Shopify stores and shipping partners that actually hold the records.
- Keystone is also destroying 18,835 devices after attackers stole the key that verifies its hardware.
OneKey’s founder Yishi Wang has committed to deleting customer data within 30 days following an admission of failure from rival hardware wallet maker Keystone regarding its 180-day deletion system after a breach that exposed nearly 26,000 buyer records.
Keystone’s help center noted that the final deletion of user records is handled by Shopify. That disclosure exposes a security flaw at the level of Shopify stores and logistics firms, beyond wallet makers like OneKey and Keystone’s control, despite the former’s 30-day pledge
Why OneKey is cutting its data retention window
OneKey’s Yishi Wang confirmed on Tuesday that the hardware wallet maker is auditing its own security system after recent breaches and supply chain attacks exposed security flaws in the sector it operates in.
Wang stressed that the move is precautionary, writing that “OneKey has NOT experienced a security” incident. Rather, the decision to cap data retention at 30 days is a direct answer to what went wrong elsewhere.
The reasoning behind the shorter data retention window is that the longer a vendor keeps customer data, the larger the pool of customer data that can be exposed in breaches.
What caused the Keystone breach?
Keystone revealed that the system that automatically deletes customer data at the end of its 180-day data retention period had stopped working without setting off any red flags. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company said.
Keystone found 25,964 records still carried personal data, names, shipping addresses, contact details and purchase histories during a review of 51,083 Shopify buyer records. Apparently, data going back to 2024 were still retained, way past the 180-day limit the firm highlighted after Ledger customers learned of a leak at e-commerce partner Global-e in January 2026.
Investigators found sensitive details in another 12,873 unpaid checkout records.
In response, Keystone has now shortened its retention window to 90 days.
Keystone also revealed on October 26 that attackers also lifted the WebAuth key its devices use to prove they are genuine, tracing the break-in to a flaw in a third-party monitoring tool that let intruders raise their access. Keystone first spotted the activity on October 20.
Because the key is burned into each device during manufacturing and cannot be overwritten, Keystone plans to destroy all 18,835 units in inventory that carry it. New wallets get a replacement key.
The firm has halted shipments of outstanding website orders and moved to preorders.
Deletion promises are only as good as the partners holding the data
Notably, hardware wallet makers are not the only ones who keep customer data. E-commerce platforms and shipping partners also handle customer names, addresses and order histories, and that level is where most of the recent breaches have occurred.
Trezor’s data leak reached 81,000 customers after its shipping partner ShipMonk failed to delete records despite repeated written assurances. SafePal exposed about 39,798 customers through an order-tracking flaw and has since pulled its retention down to 90 days. Ledger confirmed that resold devices from CryptoBilis hid chips that captured recovery phrases. Cryptopolitan, citing on-chain researchers, estimated losses at more than $86 million.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
Why is OneKey cutting its data retention to 30 days?
OneKey's Yishi said on X that the firm is strengthening its security after a wave of data breaches and supply-chain attacks across the hardware wallet industry, and stated OneKey itself has not been breached.
What did Keystone admit about its 180-day deletion policy?
Keystone said its automated deletion system malfunctioned, leaving 25,964 of 51,083 Shopify records with personal data past the 180-day limit, and stated it failed to fulfill its commitment to erase the data on time.
Why is Keystone destroying 18,835 hardware wallets?
Attackers stole the authentication key Keystone uses to verify genuine devices, and because the key is embedded during manufacturing and cannot be rewritten, the company is scrapping all 18,835 affected units and suspending shipments.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
