Keystone Wallet Data Breach: What Customers Should Do Now to Stay Safe From Phishing

Disclosure: This article contains affiliate links. As an Amazon Associate, Daily Crypto Hub earns from qualifying purchases at no extra cost to you.

Keystone, the company behind the air-gapped Keystone hardware wallets, disclosed on October 24 that an outsider got into its online store and took customer shipping information. Keystone says no funds, recovery phrases or private keys were exposed. If you bought a device from the official store, though, your name, contact details, home address and the fact that you own a crypto wallet may now be in someone else’s hands.

This guide covers what Keystone has confirmed, why a leak like this matters even when no crypto is stolen, and a step-by-step plan for affected customers. Most of it also applies to anyone who has ever bought a hardware wallet online.

What Keystone has confirmed so far

Here is the timeline as reported by Crypto Briefing, CoinCentral, CryptoPotato and other outlets citing Keystone’s statement:

• October 20: Keystone detected unauthorized access to its website.
• October 23: After reviewing API activity with Shopify, its e-commerce provider, the company confirmed that a third party had obtained customer shipping information.
• October 24: Keystone disclosed the incident publicly and started emailing affected customers.

What was exposed: customer names, contact details, shipping addresses and order details, including which items were bought and what they cost.

What Keystone says was not exposed: payment card and bank details, recovery (seed) phrases, private keys and wallet passwords. That fits how the devices work. A Keystone wallet creates and stores its keys offline, so the online store never has them.

Keystone says it blocked the access, patched the vulnerability and opened an investigation. It has promised a more detailed report. As of this writing, the company hasn’t said how many customers were affected, how the intruder got in or who was behind it. All of these details come from Keystone itself and haven’t been independently verified.

Why this keeps happening to hardware wallet buyers

Keystone is the latest wallet company in a string of 2026 customer-data incidents:

• Trezor: In August, Trezor disclosed a breach at its shipping partner that exposed the names, emails, phone numbers and shipping addresses of roughly 14,000 customers. Trezor later said the partner had kept data it had certified as deleted. According to Infosecurity Magazine, the total eventually reached about 81,000 customers. Trezor said its own systems and devices were not compromised.
• SafePal: Also in August, SafePal said a flaw in its order-tracking system exposed personal information for nearly 40,000 customers. Again, seed phrases and private keys were not involved.

The pattern is clear. Attackers rarely break the wallets. They go after the store, the shipping partner or the support system, because those hold the most useful list of all: verified crypto owners with real home addresses. As we covered in our guide to buying a hardware wallet safely, the weak points tend to be the supply chain and the people around the device, not the device itself.

Why a leaked address matters even if no coins are stolen

Breaches like this lead to two kinds of risk.

1. Targeted phishing. Keystone has warned that scammers may pose as company representatives and offer refunds, replacement devices or help with orders. A scammer who knows your name, address and exact order can write a convincing email, text or even paper letter. The goal is always the same: get you to type your recovery phrase somewhere, or install fake “firmware” or a fake companion app.

2. Physical “wrench attacks.” This risk is rarer but more serious. CertiK verified 52 wrench attacks worldwide in the first half of 2026, up about a third from a year earlier, and home invasions became far more common. Chainalysis has said victims are often chosen through data leaks, social media or insider information. Most people on a leaked customer list will never face anything like this. Still, it is why an exposed home address deserves more care than an exposed email.

Step-by-step: what to do if you’re a Keystone customer

Step 1: Confirm you’re on the list, without clicking anything

Look for Keystone’s notification email, but don’t click links in any message about the breach. Go to Keystone’s official website and social accounts directly by typing the address yourself, and read updates there. Keystone has said its detailed report is coming.

Step 2: Lock in the golden rule

No real company will ever ask for your 12- or 24-word recovery phrase. That includes Keystone, Shopify, a “support agent,” a “refund department” and a “compliance team.” Anyone who asks is trying to rob you. Don’t sign transactions you didn’t start, and only install firmware or apps from sources you’ve verified yourself.

Step 3: Treat unexpected packages as hostile

Leaked buyer lists have been used before to mail out fake “replacement” devices. If a wallet arrives that you didn’t order, don’t plug it in or set it up. Contact the manufacturer through its official channels. And never move funds to a device that came with a pre-printed recovery phrase.

Step 4: Harden the accounts tied to your order email

The email on your order is now a phishing target. Give it a unique password and move it from SMS codes to app-based or hardware-key two-factor authentication. A FIDO2 security key such as the YubiKey 5C NFC (check current price on Amazon) is a strong upgrade because it won’t authenticate on a lookalike phishing site. Add one to your exchange accounts too.

Step 5: Audit your seed phrase backup

The breach didn’t expose your seed phrase, but it’s a good moment to check where your backup lives and who could find it. Paper backups can burn, fade or get thrown away. A stamped steel backup such as the Billfodl steel seed phrase backup survives fire and water. Store it somewhere private, not on a desk or in an obvious drawer. Our free Seed Phrase Backup Checklist walks through the common mistakes.

Step 6: Secure the physical side

Store your hardware wallet and metal backup in different places so that one break-in can’t expose both. A fire-resistant home safe, such as a SentrySafe fireproof and waterproof safe (check current price on Amazon), works well as one location. A safe deposit box or a trusted relative’s home can serve as the other. Also shred the box, packing slip and shipping label from any wallet purchase. A cross-cut paper shredder stops a label in your recycling bin from announcing that a crypto holder lives here.

Step 7: Reduce your public footprint

Leaks become dangerous when they can be linked to other information about you. Avoid posting about your holdings, your portfolio size or a new hardware wallet on social media under your real name. If you want to be extra careful, consider having future crypto-related orders sent to a PO box or a package pickup point.

Step 8 (optional): Consider a passphrase or multisig

Larger holders can add a BIP-39 passphrase or move to a 2-of-3 multisig. Then no single device or backup is enough to spend funds. We explain the setup in our 2-of-3 Bitcoin multisig guide.

Quick checklist

• Never type or say your recovery phrase to anyone, for any reason.
• Get breach updates only from Keystone’s official site and accounts, reached directly.
• Ignore “refund,” “replacement” and “account verification” messages.
• Don’t set up any device you didn’t order.
• Move your email and exchange logins to hardware-key or app-based 2FA.
• Keep the device and the seed backup in separate, secure places.
• Shred packaging and labels from crypto purchases.

Unsure whether your coins should sit on an exchange, in a hot wallet or in cold storage? Our Exchange vs Hot Wallet vs Cold Wallet checker can help you decide.

What to watch next

• Keystone’s detailed report: Watch for the number of affected customers, how the attacker got in and whether any third-party Shopify app was involved.
• Revised victim counts: The Trezor incident grew several times larger after the first disclosure. Keep watching even if you weren’t notified at first.
• Phishing waves: Fake Keystone emails, texts and letters could show up in the coming weeks. Be most suspicious of anything mentioning refunds or replacements.
• Industry response: After three wallet-company data incidents since August, expect more questions about how much buyer data these firms and their partners keep, and for how long.

Frequently asked questions

Is my crypto at risk from the Keystone breach?

Not directly, according to Keystone. The company says recovery phrases, private keys and wallet passwords were not exposed, and Keystone devices keep keys offline. The real risk is indirect: scams and phishing aimed at people whose names and addresses leaked.

Should I stop using my Keystone wallet?

Keystone says its devices and keys were not affected. The stolen data came from the online store, not the wallets. Moving funds won’t change the fact that your address leaked. What matters most is refusing phishing attempts and protecting your seed phrase.

Do I need a new seed phrase?

Not because of this breach, based on what Keystone has disclosed. You should create a new wallet and move your funds if you ever typed your seed phrase into a website, app or form, or if anyone else has seen it.

How can I tell a real Keystone email from a fake?

Assume any message about the breach could be fake. Don’t click its links. Instead, open Keystone’s official website on your own and compare. Any message asking for your recovery phrase, offering a replacement device or pushing you to act fast is a scam.

Were Trezor and SafePal hacked the same way?

Not exactly. Trezor’s exposure came through a shipping partner, and SafePal’s through an order-tracking flaw. Keystone’s came through its website and store. In all three cases, the companies said wallets, seed phrases and private keys were not affected. The data at risk was customer contact and shipping information.

This article is for informational purposes only and does not constitute financial advice.