Keystone hardware wallet website hit by unauthorized access, user names and shipping addresses leaked

October 25: Keystone, a hardware wallet maker, said in a post on X that it detected unauthorized access to its official website on October 20, and after verifying API activity with Shopify, confirmed on October 23 that a third party had obtained customer shipping information. The leaked data includes names, contact information, shipping addresses and order details (products and prices); payment card or bank information, recovery phrases, private keys and wallet passwords were not compromised. Keystone said it has blocked the access, patched the vulnerability and launched an investigation, and is notifying affected users by email. It also warned users to be alert to scammers impersonating Keystone via phone calls, text messages, emails or letters under the pretext of refunds or device replacements, and never to provide recovery phrases or private keys to anyone.