‼️ Crypto hardware wallet maker Keystone says hackers stole its customers' names, contact details and shipping addresses.
The records also show what each buyer ordered and paid.
Keystone now warns buyers never to enter their recovery phrase into a device they didn't order.
The records also show what each buyer ordered and paid.
Keystone now warns buyers never to enter their recovery phrase into a device they didn't order.
Oct 24, 2026 · 9:14 PM UTC
14
37
196
15,116
Source:
x.com/KeystoneWallet…
x.com/KeystoneWallet…
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
0
0
7
2,953
@IntCyberDigest self custody: keys offline, seed on a steel plate, home address in a shopify export
0
0
4
199
@IntCyberDigest You buy a cold wallet so nobody knows you hold crypto. Now a list says who bought one and where they sleep. How long before a fake "replacement device" shows up at the door?
1
0
2
180
@IntCyberDigest Running hosting since 2007, the leak that hurts most is rarely the card data. It is the shipping list. Attackers now know who owns a hardware wallet and where it gets delivered. Expect "replacement" devices in the mail. Anything you didn't order goes in the bin.
0
1
2
220
@IntCyberDigest a shipping list of people who own hardware wallets is worth more than the wallets
0
0
0
69
@IntCyberDigest World is going nuts these past two weeks 🥺
0
0
0
136
