Keystone, a manufacturer of hardware cryptocurrency wallets, confirmed a security breach on its website. The company detected suspicious activity earlier in the week and verified on Friday, through an analysis of Shopify API logs, that an unauthorized third party gained access to customer shipping data.
The compromised information includes names, contact details, shipping addresses, and specific order history. Keystone stated that it has blocked the unauthorized access, addressed the vulnerability, and initiated an investigation. The company is currently notifying affected customers via email.
The incident has sparked concerns regarding the company's data retention practices. Although Keystone announced in 2023 that it would limit data storage to 180 days, several customers reported receiving breach notifications for orders placed over two years ago. The company has not yet clarified why this older data remained accessible.
Security experts and users have warned that the leak could facilitate targeted phishing campaigns or physical threats. Researcher Taylor Monahan noted the risk of physical attacks, while blockchain security firm CertiK reported 52 verified instances of physical violence against crypto holders in the first half of 2026, representing a 33% increase compared to the same period in 2025.
