SafePal

when

Hardware wallet manufacturer Keystone has <a href="https://x.com/KeystoneWallet/status/2114054080754770137" rel="noopener noreferrer nofollow">confirmed a customer data breach</a> that exposed names, contact information, shipping addresses and purchase records after an unauthorized third party accessed its website.
The company detected suspicious access on October 20, 2026, and confirmed the theft on October 23 after examining Shopify API activity. The compromised records included products purchased and their prices, giving the attacker information that could identify hardware wallet owners and their physical addresses.
Keystone disclosed the incident publicly on October 24, confirming that payment card details, bank information, recovery phrases, private keys and wallet passwords were not exposed.
The manufacturer has blocked the unauthorized access, patched the vulnerability and begun notifying affected customers by email. The number of exposed customers and the exact method used to access their information remain undisclosed.
<h2 id="shopify-api-activity-exposed-customer-purchase-records">Shopify API Activity Exposed Customer Purchase Records</h2>
Keystone’s investigation identified unauthorized access involving the e-commerce infrastructure supporting its website, rather than a compromise of its hardware wallet devices.
The exposed information combines customer identities and delivery addresses with specific purchase histories, creating opportunities for attackers to impersonate the manufacturer using genuine transaction details.
An attacker could reference a customer’s actual order, purchased device or shipping address when attempting to obtain additional information through fraudulent calls, emails or messages.
Keystone has warned that scammers may offer refunds, replacement <a href="https://cryptoadventure.com/best-hardware-wallets-to-use-in-2026-secure-cold-storage-without-the-confusion/" rel="noopener noreferrer nofollow">hardware wallets</a> or assistance resolving supposed delivery problems. Such communications could be delivered through email, text messages, telephone calls or physical mail.
The company has not identified the attacker, established how many records were obtained or disclosed whether the intrusion involved compromised API credentials, an application vulnerability or another access method.
Shopify’s involvement in the API investigation does not establish that Shopify’s wider infrastructure was compromised.
<h2 id="keystone-joins-trezor-safepal-and-ledger-in-customer-data-breaches">Keystone Joins Trezor, SafePal and Ledger in Customer Data Breaches</h2>
Keystone’s exposure follows several similar incidents involving cryptocurrency wallet manufacturers and their e-commerce partners.
In September, Trezor expanded its investigation into a <a href="https://cryptoadventure.com/trezor-shipmonk-breach-expands-to-67000-more-u-s-customers/" rel="noopener noreferrer nofollow">ShipMonk data breach</a> after discovering that approximately 67,000 additional American customers had their personal information exposed.
The affected records included names, phone numbers, email addresses, shipping details and order histories dating back to 2019. The discovery significantly increased the scope of an incident initially involving 13,689 customers.
SafePal also disclosed an <a href="https://cryptoadventure.com/safepal-order-tracking-flaw-exposes-data-of-39798-customers/" rel="noopener noreferrer nofollow">order-tracking vulnerability</a> in August that exposed personal and purchase information belonging to 39,798 customers. The company traced the incident to an authorization flaw in a plug-in used for accessing shipment information.
Earlier in January, Ledger customers faced <a href="https://cryptoadventure.com/ledger-users-targeted-in-phishing-scam-following-global-e-data-breach/" rel="noopener noreferrer nofollow">targeted phishing attempts</a> following a breach at e-commerce partner Global-e. Fraudulent messages circulated using customer information exposed through the third-party provider.
These incidents involved customer information held by commercial or fulfillment systems, although their technical causes and affected infrastructure differed.
<h2 id="keystone-warns-customers-against-fake-replacement-devices">Keystone Warns Customers Against Fake Replacement Devices</h2>
Keystone has urged customers to avoid links in unexpected communications and access its <a href="https://keyst.one/" rel="noopener noreferrer nofollow">official website</a> directly when seeking support.
The manufacturer specifically warned against entering recovery phrases into unsolicited replacement devices or <a href="https://cryptoadventure.com/how-wallet-private-keys-and-seed-phrases-get-leaked/" rel="noopener noreferrer nofollow">sharing private keys with anyone</a> claiming to represent its customer service team.
Anyone who has already disclosed a recovery phrase to a suspected scammer should treat that wallet as compromised and move remaining assets to a new wallet generated with a fresh recovery phrase.
Keystone is continuing its investigation and plans to publish a detailed technical report in the coming days.
The company has not disclosed evidence of cryptocurrency theft resulting from the breach or confirmed a timetable for completing customer notifications. Its forthcoming investigation report is expected to provide further details about the intrusion and affected customer records.
The post <a href="https://cryptoadventure.com/keystone-data-breach-exposes-customer-addresses-and-purchase-details/" rel="noopener noreferrer nofollow">Keystone Data Breach Exposes Customer Addresses and Purchase Details</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Keystone Data Breach Exposes Customer Addresses and Purchase Details

Table of Contents

Crypto Adventure

Other articles published on Oct 25, 2026

Join our free newsletter for daily crypto updates!