Keystone Wallet discloses breach of customer shipping data
Regulation & Gov ·
The hardware wallet maker says private keys were not exposed in an incident affecting shipping information tied to customer orders.
Keystone Wallet disclosed that a breach exposed customer shipping data but stated that private keys were not compromised, according to a statement from the company. The breach has been described as originating from a third-party compromise of Keystone's website that exposed customer shipping details, a characterization that aligns with the company's own disclosure.
For a hardware wallet maker, the distinction between shipping data and private keys is central to how customers should weigh the incident. Private keys are the cryptographic material that proves ownership and authorizes movement of on-chain assets, information wallets are built specifically to manage and protect, as outlined in a broader explainer on wallet mechanics. Shipping data, by contrast, relates to order fulfillment rather than custody of funds, meaning the breach as described does not by itself translate into a path for attackers to access customers' crypto holdings.
Two sources are tracking this cluster, with the corroborating account describing the same third-party website compromise and the same scope limited to shipping details. Both characterizations agree on the core claim: shipping information was exposed, and private keys were not part of the compromised data.
What remains unresolved is the scale of the breach — how many customers had shipping data exposed, when the compromise occurred and was discovered, and what specific third-party system or vector was involved. Keystone has not detailed remediation steps, whether affected customers are being individually notified, or whether any downstream risks exist from exposed shipping addresses, such as targeted phishing or physical-world follow-up attacks against known hardware wallet owners. Further disclosure from the company would be needed to assess the full scope of the incident.