Keystone Hardware Wallet has confirmed that unauthorized access to its website exposed customer shipping and order information, while emphasizing that seed phrases and private keys stored on its hardware devices were not compromised. The breach was detected on October 20 and confirmed on October 23, according to reports from WuBlockchain. Keystone said it has fixed the vulnerability, is notifying affected customers, and warning users about potential impersonation scams.
Exposed data included customer names, contact details, shipping addresses, and purchased items. Keystone stated that payment card details and private keys remain secure, and that website infrastructure is kept separate from cryptographic key storage. However, the company has not yet publicly confirmed the number of affected customers, the method of intrusion, the full timeframe of the breach, or all categories of exposed information.
Security observers noted that the incident highlights the distinct threat surfaces of web infrastructure and wallet hardware. Even if device keys are not reached, leaked email addresses and purchase histories can be used for targeted phishing and social engineering. Keystone customers were advised to treat unsolicited communications claiming to be from the company with caution until a full disclosure is published.
The breach fits a wider pattern of attacks on crypto companies' web-facing systems, including e-commerce backends and customer databases. Recent examples include a wallet-related breach at SecondFi involving a $2.4 million Cardano wallet compromise, and a separate protocol-level exploit in which a hacker printed $2.7 million in crypto before the Initia blockchain halted. For Bitcoin users, the key distinction is that properly secured hardware wallets with offline seed generation should not be directly threatened by a website database breach.
