Keystone Breach Exposes Wallet Buyers’ Addresses to Targeted Scams

Crypto hardware wallet maker Keystone disclosed a website breach that exposed customer shipping information after detecting suspicious activity and reviewing API activity with Shopify. The affected data included names, contact details, shipping addresses and order information, including the products purchased. Keystone said it blocked unauthorized access, fixed the vulnerability, opened an investigation and began notifying affected customers, but did not disclose how many people were impacted.

The leak creates risks beyond conventional phishing. Security researcher Taylor Monahan warned that exposed home addresses could help criminals identify high-value crypto holders for scams, kidnapping or other physical attacks. According to blockchain security firm CertiK, 52 verified “wrench attacks” were recorded worldwide in the first half of 2026, up 33% from 39 in the same period a year earlier. These incidents involve threats or violence used to force cryptocurrency owners to surrender their assets.

The breach has also raised questions about Keystone’s data-retention practices. In a 2023 blog post, the company said it had reduced customer-data retention to 180 days following security incidents involving other hardware wallet manufacturers. However, some customers said they were notified about the breach despite purchasing devices more than two years ago, suggesting that at least some older order information may have remained accessible.

One customer, an X user identified as “OG DEGEN,” said a scammer posing as law enforcement referenced details from a 2024 Keystone order. The caller reportedly tried to convince the customer that their private keys had been exposed and then directed them to a phishing link claiming to reset the wallet. Another X user, trintaetres, also reported receiving a breach notification despite buying a device years earlier.