Customer Data Leaked at Crypto Wallet Maker After Webshop Attack

An unauthorized party has stolen customer data from Keystone's webshop. The company states that the hardware wallets themselves were not affected. The combination of contact, address, and purchase information allows criminals to send highly credible messages to customers.

In Brief:

• Names, contact details, delivery addresses, and order information have been leaked.

• Recovery phrases, private keys, wallet passwords, and payment information have not been compromised, according to Keystone.

• Customers should be wary of fake messages about refunds, replacement devices, and delivery issues.

Attacker Knows Who Purchased a Hardware Wallet

Keystone discovered unauthorized access to its website on October 20. After checking activity via Shopify, the company confirmed on October 23 that a third party had stolen customer data. This included names, contact details, delivery addresses, and order details, including purchased products and paid prices. Keystone Hardware Wallet
@KeystoneWallet
·Follow

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we Show more
5:59 PM · Oct 24, 2026
1.6K
Reply
Copy link
Read 388 replies

The company announced the leak a day later in a statement shared by Wu Blockchain on X. Keystone has not yet reported how many customers were affected or the order period involved. Access has reportedly been blocked, the security vulnerability has been patched, and affected customers are being informed via email.

The stolen data does not tell attackers how much crypto someone owns. However, it does show who purchased a device for managing crypto and the address where that person lives. A similar leak at a payment partner of Ledger previously led to warnings about targeted phishing.

Secret Access Not Leaked According to Keystone

Keystone emphasizes that payment card and bank details were not compromised. Recovery phrases, private keys, and wallet passwords have also reportedly remained intact. Therefore, there is no indication that the attacker gained direct access to customers' cryptocurrencies through this data leak.

A recovery phrase is the series of words that can restore a crypto wallet on another device. Anyone who obtains these words can move the crypto. Therefore, such a recovery phrase should never be shared, even with someone claiming to call or email on behalf of Keystone.

Beware of Fake Replacements and False Refunds

Keystone warns customers about phone calls, emails, text messages, and letters in which criminals may mention real order details. They may impersonate an employee and offer a refund, send a replacement device, or claim that the delivery address needs to be changed.

Do not click on links in unexpected messages and do not use unsolicited replacement devices. Open Keystone's website by typing the address directly into your browser and verify suspicious communications through the official customer service. Previously, holders of Ledger and Trezor wallets received fake letters with QR codes that were meant to lure them to a phishing site.

Keystone has announced a more extensive investigation report but has not yet provided a publication date.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.