Hardware wallet manufacturer Keystone disclosed a website security breach that exposed customer shipping information, including names, contact details, and physical addresses. The company stated it detected suspicious activity earlier in the week and confirmed on Friday that an unauthorized third party accessed this data through its Shopify integration. Keystone indicated it has blocked access, fixed the vulnerability, opened an investigation, and is notifying affected customers via email.
The breach raises immediate concerns regarding targeted phishing attacks and potential physical threats. Security researcher Taylor Monahan highlighted that leaked shipping addresses could expose cryptocurrency holders to "wrench attacks," where criminals use violence or threats to force asset surrender. Data from blockchain security firm CertiK indicates 52 verified wrench attacks occurred worldwide in the first half of 2026, a 33% increase from the 39 incidents recorded during the same period in the previous year.
Questions have emerged regarding Keystone’s adherence to its own data retention policies. In a 2023 blog post, the company claimed it reduced its customer data retention period to 180 days following security incidents affecting other hardware wallet manufacturers. However, several users reported receiving breach notifications for devices purchased more than two years ago, suggesting older order records may not have been deleted as promised. One user, identified as "OG DEGEN," reported receiving a call from a scammer posing as law enforcement who possessed personal details linked to a 2024 purchase. Keystone did not disclose the total number of affected customers and did not respond to requests for clarification on how data older than 180 days was retained.
This incident underscores the critical intersection between digital infrastructure vulnerabilities and physical safety risks for cryptocurrency holders. While the technical scope appears limited to e-commerce metadata rather than private keys or seed phrases, the exposure of shipping addresses transforms a standard data leak into a tangible security threat. The rise in wrench attacks documented by CertiK illustrates that attackers are increasingly leveraging public or breached personal data to identify high-value targets, making address hygiene a paramount concern for self-custody users.
Keystone’s failure to enforce its stated 180-day data retention policy introduces significant compliance and credibility risks. If the company retained sensitive customer data beyond its announced limits, it contradicts prior assurances made to the community after industry-wide security scares. This discrepancy suggests potential gaps in internal data governance processes, which could erode trust among institutional and retail investors who rely on hardware wallets as a secure storage solution. The lack of transparency regarding the exact number of affected users further complicates risk assessment for those holding assets with Keystone devices.
