Keystone customers say breach exposed data the hardware wallet maker promised to delete

Hardware wallet maker Keystone said a third party obtained customer shipping information from its Shopify-powered online store, exposing sensitive customer information including names, contact details, shipping addresses and order details, such as the items purchased and their prices.

In an X post at 1:59 p.m. ET on Saturday, Keystone said it had detected unauthorized access to its official website on Oct. 20. Three days later, "after verifying API activity with Shopify," which powers its online store, the company confirmed that an unidentified third party had obtained sensitive customer information. "You trusted us with those details, and we're sorry we didn't keep them safe," Keystone wrote.

Keystone said financial information such as the customers' payment cards and bank details, and sensitive cryptographic information like recovery phrases, private keys and wallet passwords were not exposed in the breach. 

"We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers," the company said. Keystone did not say how many customers were affected, how the attacker got in, and whether they've exchanged communications with or identified the attacker. The firm has told users on X who asked about the scope of the breach that it is "still conducting a thorough investigation." Keystone said a detailed report will follow in the coming days.

Keystone warned that scammers may pose as the company by phone, text, email or mail, offering refunds, replacement devices or "fixes" for orders and addresses. It told customers never to enter a recovery phrase into a device they did not order, and not to follow links sent in messages supposedly from Keystone. 

Keystone pledged to delete information 180 days after purchase

Keystone in the past pitched its data retention policy as a selling point. On Jan. 5, the day Ledger customers were notified of a similar data leak at that wallet manufacturer's e-commerce partner Global-e, Keystone posted on X: "180 days after your order, your shipping data is permanently deleted." In a March post, the company wrote, "Other hardware wallets keep your data forever. We delete your shipping info in 180 days max." Other posts in August reinforce the same message.

The company's Privacy Promise page says that "all shipping information is automatically deleted 180 days after your order is placed." Keystone's privacy policy, last updated in May 2021, words the rule differently: it says Keystone erases "all order information of each customer who has not made an order within the last 180 days." A help center article about deletion requests clarifies that "records of the customer's city and country will not be deleted," and that "the final deletion process is handled by Shopify."

Customers claim data from older orders was still exposed

Several customers have said on X that their data was exposed anyway. "I bought it over two years ago. I received an email notification," @trintaetres_33 wrote on Saturday. Another user, @BlockchainBarmy, said 214 days had passed between their last order and the breach.

@PEPE_Whale69 even raised the alarm about a possible breach before Keystone did. In a post on Friday evening, the user said a caller spoofing a Montreal police number had tried to social-engineer them, at one point asking whether Amazon, eBay or Keystone "meant anything" to them. The X user said the caller had details perfectly matching a Keystone order they placed in 2024, well before the claimed 180-day deletion period.

Keystone's X account replied at 1:08 a.m. ET on Saturday that it had "initiated an urgent investigation into this matter." The company says it confirmed the breach on Oct. 23.

The Block could not verify the users' claims, and Keystone has not publicly responded to questions about whether it followed the 180-day policy. The Block has reached out to the X users with requests for more information. 

A recent wave of hardware wallet breaches

Keystone is the latest hardware wallet maker to disclose a customer data leak this year. In August, Trezor said a breach at its shipping partner ShipMonk exposed personal data of nearly 14,000 customers. The company later said the breach affected about 67,000 more U.S. customers, and that ShipMonk had given written assurances the data was deleted when it had not been.

Days after Trezor's first disclosure, SafePal said a flaw in its order-tracking system exposed personal information of nearly 40,000 customers. Earlier this month, Ledger confirmed that devices sold by reseller CryptoBilis contained hardware implants that capture recovery phrases during setup, and onchain researchers estimated losses at more than $86 million.

The Block has reached out to Keystone for comment.