Hardware Wallet Manufacturer Keystone Confirms Unauthorized Access to Website and Customer Information Leak
Hardware wallet manufacturer Keystone discovered unauthorized access to its official website on October 20. After verifying API activity with Shopify, it confirmed on October 23 that a third party obtained customer shipping information.
The leaked information includes names, contact details, shipping addresses, and order details (products and prices). Payment card or bank information, mnemonic phrases, private keys, and wallet passwords were not leaked. Keystone stated that it has blocked access, fixed vulnerabilities, and launched an investigation, notifying affected users via email.
Keystone posted an apology on official channels and reminded users to be vigilant against impersonators claiming to be the company through phone calls, text messages, emails, or letters, attempting scams under the pretext of refunds, device replacements, or address corrections. The company emphasized that it will never ask for mnemonic phrases or private keys, and users should not click on unknown links but should enter the official website address themselves.
Keystone is a manufacturer of air-gapped hardware wallets that support Bitcoin, Ethereum, and multi-chain. The official website uses Shopify for its e-commerce process. This incident only involves customer data from the e-commerce system and did not affect the devices themselves or key storage. The company stated that it will release a detailed investigation report and urged users to trust only official channels. If there are any anomalies, they can contact support@keyst.one.
After the user data leak, the risk of phishing attacks has increased, as attackers can use real order information to enhance their disguise's credibility. Keystone has publicly acknowledged the incident and proactively disclosed the scope of what was not leaked to reduce the likelihood of further social engineering attacks.
In the hardware wallet market, customer trust is built on key isolation and brand reliability. This incident drives funds and attention towards competitors that emphasize supply chain audits and e-commerce security, while reinforcing the demand for personal information protection among self-custody users. Beneficiaries are manufacturers that have established stricter data minimization practices, while wallet brands relying on third-party e-commerce platforms face pressure.
Source: Public Information
ABAB AI Insight
Keystone positions itself with air-gapped and open-source design, and has not previously experienced large-scale key leaks. However, its e-commerce process relies on Shopify, similar to the path of phishing attacks following the 2019 Ledger customer database leak, where customer information was used for targeted scams over a long period.
In terms of capital and resource pathways, Keystone processes orders and logistics through Shopify, making third-party APIs an attack entry point. The company chose to disclose publicly and notify via email rather than conceal the incident, to maintain the trust premium of its hardware wallet brand among self-custody users.
This directly parallels the case of Ledger's e-commerce system being breached in 2020, leading to the leakage of customer emails and addresses. The hardware wallet industry is currently transitioning from "device security" to "full-link data security."
Essentially, this represents a transfer of pricing power: attackers are no longer seeking to directly obtain private keys but are instead using real customer lists to enhance phishing success rates, increasing the cost of brand trust and raising user verification requirements for "official channels." The mechanism is that once the boundary between e-commerce data and key security is breached, the marginal cost of social engineering attacks significantly decreases.
ABAB News · Cognitive Laws
Real orders make scams harder to detect
Key security does not equal customer data security
E-commerce platforms are a new attack surface for hardware wallets