Keystone Wallet Data Breach Exposes Buyers' Addresses to Scammers - Bitcoin News

Keystone detected suspicious access to its systems on Oct. 20 and traced the intrusion to its e-commerce provider, Shopify. By Oct. 23, the company confirmed that an unauthorized third party obtained customer names, contact information, shipping addresses, and purchase details. Keystone blocked the intrusion and patched the vulnerability but has not disclosed the number of affected buyers or the exact method of the breach.

The immediate risk is not the theft of funds, but the potential for scammers to impersonate the company. Keystone warned customers about fraudulent refund offers, replacement device requests, and unsolicited messages asking for sensitive information. The company emphasized that it never requests recovery phrases or private keys.

One X user reported receiving a call from a spoofed Montreal police number on Oct. 23, the day before Keystone confirmed the attack. The user claimed the caller attempted to social-engineer them using the leaked information. Customers are advised to independently verify communications through Keystone’s official website rather than following unexpected links.

Keystone’s disclosure adds the company to a growing list of hardware wallet manufacturers facing security problems in 2026. Coldcard faced a massive bug with weak seed-generation randomness, while Ledger confronted reports of tampered devices distributed through a reseller. Trezor and Safepal also disclosed customer information breaches involving third-party fulfillment or ordering systems. Unlike incidents involving compromised recovery phrases, those exposures primarily created opportunities for phishing and impersonation. For Keystone, the cryptographic defenses reportedly held, but the troubling question is whether customers’ personal information received comparable protection.