Key Points
- Cryptocurrency hardware wallet manufacturer Keystone has acknowledged that an unauthorized party gained access to customer order information, including full names, shipping addresses, and contact information.
- The company has shut down the access point, remediated the security flaw, and begun notifying impacted users via email, though the total number of affected customers remains undisclosed.
- Cybersecurity expert Taylor Monahan emphasized that compromised physical addresses put cryptocurrency owners at risk of violent robberies and abductions.
- Blockchain security company CertiK documented 52 confirmed physical attacks targeting crypto holders during the first six months of 2026, representing a 33% increase compared to the prior year’s equivalent timeframe.
- Multiple users who purchased hardware wallets more than two years prior received data breach notifications, casting doubt on Keystone’s stated 180-day information deletion protocol.
Cryptocurrency hardware wallet producer Keystone has publicly acknowledged a data security incident that compromised customer delivery information. The organization issued an apology to its user base through a statement published on X during the weekend.
According to Keystone’s disclosure, the company identified unusual system activity earlier last week. Following a comprehensive review of API transactions conducted jointly with Shopify on Friday, officials verified that an unauthorized entity had obtained access to customer records.
The compromised data encompasses full customer names, telephone numbers and email addresses, physical delivery locations, and complete order histories including purchased products and transaction amounts.
“We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” the organization stated. The company has not released figures regarding the scale of the breach.
“We owe you an apology. You trusted us with those details, and we’re sorry we didn’t keep them safe,” Keystone’s statement acknowledged.
Security Experts Highlight Physical Violence Threats
While Keystone’s initial warning focused on potential phishing schemes utilizing the stolen information, cybersecurity specialist Taylor Monahan identified a more severe risk.
Monahan emphasized that the primary threat stemming from exposed delivery addresses involves physical violence and forced abductions rather than digital fraud attempts. Criminal actors can leverage this data to locate cryptocurrency holders at their residences.
Such criminal activities are commonly referred to as “wrench attacks”—incidents where perpetrators employ intimidation or physical force to compel digital asset owners to surrender their holdings.
Cybersecurity organization CertiK documented 52 authenticated wrench attacks globally during the initial six months of 2026. This figure represents a 33% surge from the 39 incidents recorded during the corresponding timeframe in the previous year.
AMBCrypto’s data indicates 122 physical assaults connected to cryptocurrency ownership across 31 nations throughout 2026 to date, with France emerging as a particularly affected region. Chainalysis has calculated financial losses from such violent crimes exceeding $100 million through August.
This Keystone incident adds to a troubling pattern of security failures within the hardware wallet industry. Recent compromises include a supply chain attack on Ledger resulting in losses surpassing $100 million, a $116 million security flaw affecting Coldcard devices, and a data exposure at Trezor last August.
Zach Herbert, who established Foundation wallet, stated he “largely” concurs that “hardware wallets are dead.” He advocated for transitioning to an ultra-secure, open-source hardware security infrastructure.
Data Retention Practices Under Scrutiny
The security incident has prompted scrutiny of Keystone’s customer information storage practices. In a 2023 company blog entry, Keystone announced it had reduced its data retention timeframe to 180 days.
Despite this policy, several customers reported receiving breach notifications regarding devices acquired more than two years previously. This discrepancy indicates that certain historical purchase records may not have been eliminated according to the stated protocol.
An X platform user identified as “OG DEGEN” described receiving a fraudulent phone call from someone impersonating law enforcement officials discussing an alleged fraud investigation. The individual believes the caller obtained their personal information from a Keystone transaction completed in 2024.
“I think their plan was to convince me that my private keys had been exposed and then send me a phishing link to supposedly reset them,” the customer explained.
Another user on X, trintaetres, similarly confirmed receiving the breach notification despite having purchased their hardware device over two years ago.
Cointelegraph reached out to Keystone requesting clarification regarding how information from historical purchases remained accessible and the total customer count affected by the breach. The company had not provided a response at the time of publication.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
