Keystone says a website breach exposed buyers' names and shipping addresses

Keystone Hardware Wallet says unauthorized access to its official website, detected Oct. 20, led to a third party obtaining customer shipping information after Shopify API activity was verified Oct. 23, and the company disclosed the incident in an Oct. 24 statement on X [1]. "You trusted us with those details, and we're sorry we didn't keep them safe," the company wrote [1].

What Keystone says was exposed, and what was not

In the full statement, Keystone lists what a third party obtained: names, contact details, shipping addresses, and order details (items and prices) [1]. It separately lists what was not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords [1].

That split matters for how the leak reads. A hardware wallet is meant to keep signing keys offline; the ecommerce layer still holds the buyer's identity and where to deliver the device. Names and home addresses on a shipping list mark people who are likely to hold self-custody gear and give a physical location to anyone who has the file. Order lines that name the product and price sharpen that picture. They do not, on Keystone's account, hand over the secrets that move coins.

Keystone says it has blocked access, fixed the vulnerability, opened an investigation and is emailing affected customers [1]. It has not published a count of how many customers are in the affected set. A detailed report, it says, is coming soon [1].

Timeline Keystone published

Keystone's own dates are short and specific [1]:

• Oct. 20: unauthorized access to the official website detected.
• Oct. 23: after verifying API activity with Shopify, confirmation that a third party obtained customer shipping information.
• Oct. 24: public disclosure (statement posted at 1:59 p.m. ET).

Le Coin is reporting that sequence as Keystone stated it. The company has not yet published the fuller incident report it says is forthcoming [1].

Keystone's scam warnings (as attribution)

The same statement warns that scammers may pose as Keystone by phone, text, email or mail, offering refunds, replacement devices, or "fixes" for an order or address, and says none of that is from the company [1]. It states that Keystone "will never ask" for a recovery phrase or private keys, and that a recovery phrase should never be entered into a device the customer did not order [1]. Those lines are Keystone's warnings, quoted as its attribution, not instructions issued by Le Coin.

Why shipping lists sit next to self-custody

Buyers who order a hardware wallet are often trying to keep keys off exchange hot wallets and off phones. The device shipment still creates a conventional ecommerce record: who ordered, what they bought, and where it was sent. When that record leaves the merchant's control, the leak is not a seed phrase dump; it is a map of likely self-custody households. That map is useful to anyone running impersonation, doorstep or phishing campaigns that trade on the brand of the device in the box.

Ledger's July 29, 2020 leadership post on its own ecommerce and marketing database breach is one prior case in that category. Ledger said an unauthorized third party accessed a database used for order confirmations and promotional emails through an API key, involving mostly email addresses and, for a subset, contact and order details such as name, postal address, phone number or ordered products, and that payment information and credentials were not in that breach [2]. Keystone's 2026 disclosure is a separate incident on a different vendor's stack; the parallel is the class of data, shipping and order identity, not a claim that the two events share a method or a scale. Keystone has not stated a headcount; Le Coin is not inventing one.

What is still open

Keystone says a detailed report is coming and asks customers to trust only official channels, typing the company site themselves rather than following links in unexpected messages, and to email support@keyst.one if something feels off [1]. Until that report appears, the public record is the Oct. 24 statement: the Oct. 20 to 23 timeline, the exposed and not-exposed lists, the remediation steps Keystone claims, and the scam warnings it chose to publish [1].

Sources

1. Keystone Hardware Wallet (@KeystoneWallet), X statement, Oct. 24, 2026, 1:59 p.m. ET (created_at 2026-10-24T17:59:04.000Z; full text from note_tweet), https://x.com/KeystoneWallet/status/2114054080754770137, accessed Oct. 24, 2026, 6:21 p.m. ET.
2. Ledger, "Addressing the July 2020 e-commerce and marketing data breach: A Message From Ledger's Leadership," July 29, 2020, https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach, accessed Oct. 24, 2026, 6:21 p.m. ET.

Holding the Corner.

Not financial advice.