Keystone Website Breach Exposes Customer Addresses and Order Details

Keystone sells hardware wallets through a Shopify-hosted storefront, the same e-commerce layer that handles checkout for thousands of retailers. The company says it detected unauthorized access on Oct. 20 and confirmed by Oct. 23 that names, contact details, shipping addresses and order records had been taken. The breach lands months after separate security incidents at rivals Ledger and Trezor, making this the third major hardware-wallet vendor to report a customer-data exposure since summer.

Keystone destroyed 18,835 hardware wallets and halted shipments after finding that intruders also took a root device authentication key from its Shopify database, not just contact records. Customers who bought a device before Oct. 20 now have a physical shipping address tied to their crypto holdings sitting in an attacker's hands, a very different risk than a leaked password. Keystone's fix stops further website intrusion but cannot recall data already exfiltrated or verify how it will be used.

A security researcher's warning that leaked shipping data enables targeted scams and physical attacks against wallet owners exposes the gap between crypto's promise of self-custody and the conventional retail infrastructure vendors rely on to sell the devices that provide it. Keystone's own claim that it deletes customer data 180 days after an order, contested by users once the breach came to light, raises a harder question: if deletion policies aren't enforced, disclosure after the fact offers little protection.

Keystone has not detailed how the root authentication key was used or confirm it to be fully contained, leaving open whether destroying 18,835 units addresses the full scope of compromised devices. Watch for Keystone's next disclosure on whether shipments resume, and for any follow-up from Ledger or Trezor's own incident reviews, which will show whether hardware-wallet vendors treat e-commerce security as seriously as they treat the chips inside the devices themselves. (per ambcrypto.com)