Hardware wallet maker Keystone said Saturday that a third party obtained customer shipping information from its official website, and it apologized to affected buyers.
“On October 20, we detected unauthorized access to our official website,” the company wrote in a notice posted on its verified X account on Oct. 24. “After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information.”
According to the notice, the exposed data were “names, contact details, shipping addresses, and order details (items and prices).” Keystone said payment card or bank details, recovery phrases, private keys and wallet passwords were not exposed.
“We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” the company said. It has not said how many customers were affected or what period of orders the data covers. Customers asked on X how far back the affected orders go. Keystone did not give a range, and said in replies that it is “still conducting a thorough investigation and will publish a detailed report in the coming days.”
The bigger risk now is impersonation. Keystone warned that “scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or ‘fixes’ for your order or address. None of it is from us.”
The company’s guidance to customers, in its own words:
- “NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn’t order. We will never ask for them.”
- “Don’t click links in unexpected messages.” Type the company’s web address, keyst.one, directly.
- “Trust only our official channels. If anything feels off, email support@keyst.one.” (The notice says this applies until its detailed report is out.)
Hours before the notice, at about 1 a.m. ET Saturday, Keystone said on X that it had opened an urgent investigation after a customer reported a scam call that used details from a 2024 order. Hardwire Crypto has not independently verified the customer’s account.
“A detailed report is coming soon,” the notice said. “Again, we’re truly sorry to everyone affected.”
Sources: Keystone Hardware Wallet on X