Hardware wallet Keystone confirms unauthorized access to its official website, with customer names and shipping information leaked.

Hardware wallet maker Keystone has issued an apology, disclosing that it detected unauthorized access to its official website on October 20. After verifying API activity with Shopify, the firm confirmed on October 23 that a third party had obtained customers’ delivery data. The incident exposes customers’ names, contact information, shipping addresses, and order details (including product names and prices), but no bank card or account data, mnemonics, private keys, or wallet passwords were compromised. Keystone said it has blocked the unauthorized access, patched the vulnerability, launched an investigation, and is notifying affected customers via email. The company also plans to publish a full investigation report shortly, and urged users to only trust official channels in the interim. Keystone warned that scammers may impersonate the firm via phone, SMS, email, or mail, using pretexts like refunds, device replacements, or resolving order and address issues to commit fraud. Users must never share mnemonics or private keys with anyone, nor input mnemonics on devices they did not order. Do not click links in unsolicited messages; instead, manually type the official website URL to access it. Those with concerns should contact customer support through official channels.