Keystone Hardware Wallet said unauthorized access to its website exposed customer shipping and order information, creating a new phishing risk for buyers even though wallet secrets and payment credentials were not affected.

The company disclosed the incident on Oct. 24 after detecting the access on Oct. 20 and confirming the scope with Shopify API activity on Oct. 23. That sequence separates the date of the intrusion from the later verification and public notice.

Keystone Breach Exposed Shipping Data

In its Oct. 24 security disclosure, Keystone said a third party obtained customer shipping information through unauthorized access to its official website. The exposed fields included names, contact details, delivery addresses and order records showing the products and prices involved.

Keystone did not publish a customer count in the initial notice. It also did not say that its hardware-wallet firmware, private-key protections or customers’ devices were breached. The company said it would publish a more detailed report after completing further investigation.

The distinction matters because e-commerce records and wallet credentials create different risks. The disclosed data does not by itself let an attacker move cryptocurrency, but it can help scammers build convincing messages around a real purchase, delivery address or device model.

Phishing Risk Now Moves to Customers

Keystone warned that attackers may impersonate the company by email, text message, telephone or physical mail. A scam could offer a refund, replacement device or supposed fix tied to an actual order. The company said it would never ask for a recovery phrase or private key.

Customers should type Keystone’s official website address directly instead of opening links in unexpected messages. They should also reject any request to enter a recovery phrase into a replacement device they did not order. Those controls matter because possession of a recovery phrase, not the shipping record, can give an attacker control of wallet assets.

The incident adds to a broader crypto-security problem in which operational data can become a tool for social engineering. Fusion Market News previously covered how AI-assisted tracing followed the Bitget hack, while the OCC’s stablecoin rule tightened federal risk-management expectations and Ireland fined Coinbase over safeguarding gaps.

What Keystone Customers Should Watch

The most immediate signal is an unsolicited message that knows a buyer’s product, price or delivery information. That familiarity should not be treated as proof that the sender is Keystone.

Customers can independently verify notices through the company’s official channels and contact its published support address when a message appears suspicious. Keystone said it is directly notifying affected customers and urged users not to click links in unexpected communications.

The company’s promised detailed report will be important for establishing the duration of the access, the number of records involved and whether any additional controls are being changed. Until then, the confirmed scope is limited to customer and order data, not private keys or wallet recovery material.

Sharron Kendi is a seasoned crypto market analyst and writer with over three years of experience decoding blockchain trends, price movements, and market dynamics. She holds a Bachelor’s Degree in Commerce (Finance) from Kenyatta University, blending a solid academic foundation with a sharp eye for technical analysis and a deep understanding of on-chain data. Her work delivers clear, data-driven insights that empower investors to navigate the fast-evolving digital asset space with confidence.