On Friday evening a Keystone customer posted that their phone had rung with a Montreal police number on the screen. The caller knew details matching an order they had placed in 2024. The customer had bought a hardware wallet two years earlier, had it delivered, and assumed that was the end of it. Instead a stranger had their name, their address, and a list of what they paid for. That is what the Keystone data breach looks like for one person, and the call arrived before the company had said anything publicly.
Confirmation: confirmed by the company. Keystone posted its disclosure on October 24, 2026. The police-impersonation call is a customer’s own account, posted to X and not independently verified.
Keystone makes hardware wallets, which are small devices people buy to hold cryptocurrency offline. So its customer list is a list of people who own crypto, with their home addresses attached. That is the whole weight of this one.
What happened in the Keystone data breach
Keystone detected unauthorized access to its website on October 20, 2026. It then reviewed API activity with Shopify, which runs its store, and confirmed on October 23 that a third party had obtained customer shipping data. It published the disclosure on October 24 at 1:59 p.m. Eastern.
The company’s own words were direct. “You trusted us with those details, and we’re sorry we didn’t keep them safe,” it wrote, adding that it had “blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.”
Three things Keystone has not said, and each of them matters. It has not said how many customers are affected. It has not said how the attacker got in. And it has not said how far back the records go. Keystone has promised a detailed report “in the coming days.” Until that arrives, treat the scope as unknown rather than small.
The Block reported on October 25 that the exposure may reach further back than Keystone’s own policy allows. More on that below.
What the Keystone data breach exposed, and what somebody can do with it
Keystone says four categories of data were taken.
Names. The first half of a convincing greeting.
Contact details. Keystone has not broken this down, and the distinction is not academic: an email address is the channel the follow-up scam arrives on. Because the company says it is emailing affected customers, it clearly holds addresses. Whether the attacker took them is not yet confirmed either way.
Shipping addresses. This is the item you cannot change. A password can be rotated in a minute. Your street address cannot, and it is now attached to a purchase record that signals you may hold cryptocurrency at that address.
Order details — the items bought and the prices paid. So the record does not say only that you shop at Keystone. It says which device you own, which is what lets somebody write a replacement-device scam that names the right model.
Keystone says four things were not taken: payment card and bank details, recovery phrases, private keys, and device passwords. That last group is the important reassurance, because a recovery phrase is the one secret that moves the money.
The data Keystone said it had already deleted
Here is the part that turns a shipping-data breach into a retention story.
Keystone marketed deletion as a feature. A January 5 post on X read: “180 days after your order, your shipping data is permanently deleted.” A March post went further, presenting the 180-day window as something rival makers do not match. Its Privacy Promise page says all shipping information is deleted automatically 180 days after an order is placed.
Customers say the breach notices tell a different story. One wrote that they bought their device more than two years ago and still received a notification. Another counted 214 days between their last order and the breach. A third reported the spoofed police call carrying details from a 2024 order. The Block could not verify these accounts, and Keystone has not said publicly whether it followed its own policy.
There is also a gap inside Keystone’s own documents. The privacy policy, last updated in 2021, refers to order information for customers who have not ordered within the last 180 days — a rolling account clock, not a per-order one. The help center adds that city and country records are kept, and that the final deletion step is handled by Shopify. Those are three different promises, and a reader could reasonably believe any of them.
The lesson generalizes past Keystone. A deletion promise you cannot audit is a marketing claim, and the breach is the audit.
This is the third hardware wallet exposure in three months
The Keystone data breach is not an outlier, which is the uncomfortable context. In August, Trezor disclosed a breach at its shipping partner ShipMonk affecting nearly 14,000 customers, later expanded by roughly 67,000 more US customers. ShipMonk had given written assurances that the data was deleted. It had not been. Days after that first disclosure, SafePal revealed an order-tracking flaw exposing close to 40,000 customers.
We covered the Trezor case in detail in our Trezor data breach breakdown, including the fake-alert wave and the QR-code letters that followed it by post. The pattern repeats because the weak point is rarely the device. It is the order record behind it.
What to do now
Most of this has nothing to do with OptMsg.
Treat any Keystone message as unverified until you check it yourself. Keystone warned that scammers may reach out by phone, text, email or mail, offering refunds, replacement devices, or “fixes.” Its guidance is to avoid links in messages that appear to come from Keystone, and to go to the site directly instead.
Do not enter your recovery phrase into anything. Not a website, not a support chat, and not a device that showed up unrequested. A replacement wallet you did not order is a tampered wallet, and that scam has run on breached wallet-buyer lists before.
Expect the phone call, not just the email. The spoofed-police-number report is the tell: a caller who can recite your order looks legitimate for the first ten seconds. Hang up and call the organization back on a number you looked up yourself.
Use a password manager for the accounts attached to that email address. It generates a different password for every site, so one leak stays one leak.
Consider where your next package goes. If you buy hardware that signals what you hold, a locker or a work address keeps your home off the order record. That advice is dull, and it is the single thing that would have blunted this breach most.
How OptMsg changes this exposure
The Keystone data breach happened at Keystone, in Keystone’s own store. No email provider changes that, and OptMsg would not have prevented it. What an inbox changes is what reaches you afterward, and there are two things.
The first is the sign-in. Your OptMsg account has no password, so a password stolen from another site cannot open your inbox. Credential stuffing needs a password to try. That matters here because your email is the reset route into most of your other accounts, including the exchange accounts a crypto owner holds. Keep that door shut and the rest stay shut with it. This is the Private argument at its real size: fewer places your details can be collected, and a sign-in that a leaked credential cannot reach.
The second is where the next message lands. Mail from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. The refund offer and the replacement-device notice arrive from senders you have not approved, so they land in Trash rather than in the stream you read between two other things.
Now the limits, plainly. This does nothing about the phone call, because a phone is not an inbox. It does not cover a compromised device, a live phishing page you reached some other way, or somebody holding your unlocked phone. It does not retrieve the address already taken. And it would not have stopped the break-in at the store. The argument is about the blast radius on your side, and that is all it is.
Create Your Account — Your Inbox. Your Rules.
Frequently asked questions
Were my crypto funds at risk in the Keystone data breach? Keystone says recovery phrases, private keys and device passwords were not exposed. So the leaked record does not let somebody move your coins. The risk is social: a scammer who knows your name, address and device model can write a convincing message or make a convincing call.
How many Keystone customers were affected? Keystone has not published a figure, and it has not said how far back the affected orders go. It has promised a detailed report. Until then, assume your order may be included if you bought from the Keystone store.
Was my email address exposed? Keystone lists “contact details” without itemizing them, so this is unconfirmed. The company is notifying affected customers by email, which tells you it holds addresses. Watch that inbox for impersonation mail either way.
Didn’t Keystone promise to delete shipping data after 180 days? It did, in public posts and on its Privacy Promise page. Several customers say they received breach notices for orders older than that, including one from 2024. The Block could not verify those accounts, and Keystone has not addressed the question publicly.
What should I do if someone calls claiming to be Keystone or the police? Hang up and call back on a number you looked up yourself. A caller who can recite your order details is reading a leaked list, not proving an identity. Keystone’s own guidance says scammers may use phone, text, email and mail.
Sources
- The Block, “Keystone customers say breach exposed data the hardware wallet maker promised to delete,” October 25, 2026 — https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613
- FinanceFeeds, “Keystone Says Shopify Breach Exposed Customer Shipping and Order Data,” October 2026 — https://financefeeds.com/keystone-says-shopify-breach-exposed-customer-shipping-and-order-data/
- Crypto Briefing, “Keystone Hardware Wallet says website breach exposed customer data,” October 2026 — https://cryptobriefing.com/keystone-data-breach-exposed-2026/
- CryptoTicker, “Keystone Wallet Data Breach,” October 2026 — https://cryptoticker.io/en/keystone-wallet-data-breach/
- OptMsg Breach Breakdown, “Trezor Data Breach: 81,000 Addresses, a Fake Alert and QR-Code Letters” — https://optmsg.com/blog/breach-breakdown/trezor-data-breach/
Previous in Breach Breakdown: Quest Diagnostics Data Breach Exposed Patient Records: What To Do Now
Next in Breach Breakdown: The DreamHost Security Incident: Reset Your Email, Then Watch For The Fake Email.
