Keystone, a cryptocurrency hardware wallet maker, has confirmed a data breach that exposed customer names, contact details, shipping addresses, and order information.
The company said an unauthorized party accessed its official website on October 20, with the exposure confirmed three days later following an investigation into API activity involving Shopify.
In an apology published on October 24, Keystone said the compromised information included customers’ names, contact details, shipping addresses, purchased products and prices. The company has not disclosed how many customers were affected and said a more detailed report would follow as its investigation continues.
Keystone stressed that payment card and bank details, wallet recovery phrases, private keys and wallet passwords were not exposed in the incident. The breach involved customer information rather than the cryptographic secrets used to access and control funds stored in its hardware wallets.
The company said it had blocked the unauthorized access, fixed the vulnerability and begun notifying affected customers by email. However, the exposure of personal and shipping information could still put customers at risk of targeted phishing attacks.
Scammers may use the leaked details to make fraudulent messages appear legitimate, including emails or text messages about deliveries, refunds, replacement devices or order problems. By referencing real purchases and shipping addresses, attackers could attempt to persuade customers to click malicious links or disclose sensitive information.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Keystone has urged customers to remain cautious about unexpected communications claiming to come from the company. Users should avoid suspicious links, access the official website directly and never share their recovery phrases or private keys. The company also warned against entering recovery phrases into unfamiliar devices or websites, emphasizing that its support team will never request these secrets.
