Keystone wallet says third party obtained shipping data

Keystone wallet's October 24, 2026 disclosure separates the signer from the shop that ships it. Keystone Hardware Wallet says the third party took names, contact details, shipping addresses, and order details covering items and prices. The Block's October 25 account already shows that split at other makers, with personal data at a carrier or checkout vendor and the recovery phrase still on the device. Keystone's own deletion texts disagree, and the apology leaves the choice unmade. Cactus Custody's Swiss launch separated operator from audit. Here a Keystone wallet on a desk and a street address in a store API are the two systems.

The company wrote that it detected unauthorized access to its official website on October 20, 2026. After verifying API activity with Shopify, it confirmed on October 23, 2026 that a third party had obtained customer shipping information. The October 24 post says Keystone has blocked that access, fixed the vulnerability, opened an investigation, and is emailing affected customers. It leaves the customer count, the attacker's identity, and the length of access unstated. A detailed report, it said, is coming soon, and that report was still ahead when the October 25 story ran. The privacy policy dated May 15, 2021 names the operator as Yanssie HK Limited and says Shopify powers the store on keyst.one.

The post places payment card details, bank details, recovery phrases, private keys, and wallet passwords outside the exposed set. Scammers, Keystone wrote, may pose as the firm by phone, text, email, or mail, offering refunds, replacement devices, or fixes. "You trusted us with those details, and we're sorry we didn't keep them safe," the account said. Customers are told to type keyst.one themselves, to skip unexpected links, and to refuse any request for a recovery phrase. The only inbox the post names is support@keyst.one.

Related:X100 Global vote moved treasury tokens in one block

Deletion language the apology leaves open

On January 5, 2026 the account wrote, "180 days after your order, your shipping data is permanently deleted." On March 8, 2026 it wrote, "We delete your shipping info in 180 days max." The privacy promises page says shipping information is deleted 180 days after the order is placed. The 2021 policy starts the clock at the customer's last order. It defines order information as name, billing address, shipping address, email, and phone number, so a later purchase keeps the older file. The January line instead drops that shipping data at day 180.

A help-center page updated in February 2023 adds a third version: on request, name, email, phone, and street addresses come off, city and country records remain, and Shopify carries out the deletion. Zack Abrams wrote in The Block that customers on X said orders older than 180 days showed up in the exposed set, a claim The Block left unverified and that Keystone had yet to answer. At 05:08 UTC on October 24 the account told a user it had "initiated an urgent investigation into this matter." The apology at 17:59 UTC still defers the detailed report.

ZachXBT, the on-chain investigator, wrote the alert Keystone quote-tweeted that morning: "Ledger had another data breach via payment processor Global-e leaking the personal data of customers (name & other contact information)." The Block's same account says Trezor tied a ShipMonk breach to personal data of nearly 14,000 customers, a count Keystone's October 24 post leaves unstated.

What a desk can settle only after the detailed report

The new exposure for a fund desk is a street address tied to a hardware-wallet order, while the recovery phrase stayed on the device. The promises footer lists 19H MAXGRAND PLAZA, No.3 Tai Yau Street, San Po Kong, Kowloon 999077, Hong Kong. The October 24 post describes a website intrusion found through Shopify API activity, separate from any claim about that Kowloon office.

Advisers weighing self-custody, including the path in the Advisers Act custody proposal, still inherit the vendor's shop. A firm that issues a Keystone wallet to staff now tracks the device and the Shopify file the company says a third party obtained. Only the detailed report the company says is coming can say whether the exported rows followed the 2021 last-order clock or the January 2026 per-order deletion. WAX's bridge pause came with a restart, while Keystone can point to a blocked admin path and to emails it says are going out.

This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.