Keystone Bragged 'Other Hardware Wallets Keep Your Data Forever. We Delete Your Shipping Info in 180 Days Max.' Then Hackers Got Buyers' Addresses, and Customers Say Their Orders Were 2 Years Old

In March 2026, Keystone posted this on X, per The Block:

“Other hardware wallets keep your data forever. We delete your shipping info in 180 days max.”

This weekend, Keystone admitted that someone had stolen its customers’ shipping information.

Then the replies arrived. One user said: “I bought it over two years ago. I received an email notification.”

---

What Happened

Unauthorized access found	Oct 20, 2026 (Keystone)
Data theft confirmed	Oct 23, 2026, “after verifying API activity with Shopify”
Public disclosure	Sat Oct 24, 1:59 p.m. ET, on X
Where	Keystone’s Shopify-based web store
Exposed	Names, contact details, shipping addresses, order details incl. products and prices
Not exposed (per Keystone)	Payment cards, bank details, recovery phrases, private keys, wallet passwords
Customers affected	Not disclosed

Keystone’s disclosure included an apology: “You trusted us with those details, and we’re sorry we didn’t keep them safe.” The company said: “We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.” A detailed report “will follow in the coming days.”

Keystone hasn’t said how the attacker got in. As crypto.news points out, the mention of Shopify API activity doesn’t mean Shopify’s own platform was breached. It could have been a stolen API credential, an app bug, or something else, and Keystone hasn’t said which.

---

The Promise vs. The Inbox

Keystone didn’t just have a data-retention policy. It marketed one, aiming it straight at its competitors. Per The Block:

• Jan 5, 2026, the day Ledger customers were notified about a leak at its e-commerce partner Global-e, Keystone posted: “180 days after your order, your shipping data is permanently deleted.”
• March 2026: “Other hardware wallets keep your data forever. We delete your shipping info in 180 days max.”
• Its Privacy Promise page: “all shipping information is automatically deleted 180 days after your order is placed.”

Now customers are saying they got breach emails anyway:

• @trintaetres_33: “I bought it over two years ago. I received an email notification.”
• @BlockchainBarmy said 214 days had passed between their last order and the breach.
• @PEPE_Whale69 said a caller spoofing a Montreal police number had details matching a Keystone order they placed in 2024.

Caveats: The Block says it could not verify these claims. Keystone hasn’t answered public questions about whether it followed its own 180-day rule.

The fine print may be where this goes wrong. According to The Block, Keystone’s help center says “records of the customer’s city and country will not be deleted” and “the final deletion process is handled by Shopify.” The privacy policy, last updated in May 2021, describes erasing order information for customers who haven’t ordered in the last 180 days. That’s a different rule from deleting data 180 days after each order.

So “we delete it” was a tweet. The documents behind it described something narrower, with part of the job handed to a third party.

---

Why Your Address Is the Real Payload

Keystone stressed that no seeds or keys leaked, and that’s true. But a list of verified hardware-wallet buyers with home delivery addresses can be worth more to an attacker than many hot wallets.

According to crypto.news, security developer Taylor Monahan warned that leaking buyers’ shipping data could expose them to robbery and kidnapping, the “wrench attack” problem. Crypto.news also notes there’s no confirmed evidence of physical attacks linked to this breach yet.

Keystone’s own warning describes how this usually goes. Scammers pose as the company “by phone, text, email or mail” and offer refunds, replacement devices, or “fixes” for your order. Never enter a recovery phrase into a device you didn’t order, and don’t click links in “Keystone” messages. Ledger customers were sent fake letters with QR codes in 2025, after its 2020 breach exposed about 272,000 customer records.

---

2026 Is the Year Hardware Wallets Leaked Their Customers

The Block lists the incidents so far this year:

• Ledger / Global-e (Jan): a leak at Ledger’s e-commerce partner
• Trezor / ShipMonk (Aug): about 14,000 customers first, then about 67,000 more in the US. ShipMonk had given written assurances that the data had been deleted. It hadn’t.
• SafePal (Aug): an order-tracking flaw exposed nearly 40,000 customers
• Ledger / CryptoBilis (Oct): reseller devices with implants that captured seeds. On-chain researchers put losses above $86M (our coverage)
• Keystone (Oct): this one

The pattern is consistent. The secure element works fine. The weak point is the shop, the warehouse, and the vendor who says the data was deleted.

Still unconfirmed: how many Keystone customers were affected, the date range of exposed orders, the attack vector, and whether older records were really still on file.

---

Why This Matters for Crypto Jobs

Data retention is now a security job. Twice this year a vendor said data had been deleted when, according to customers or the company itself, it hadn’t. Hardware wallet makers need privacy engineers and data-governance leads who can check deletion in every system, including Shopify, 3PLs and email tools, instead of taking a vendor’s word for it.

E-commerce security is part of the threat model. For these companies, the Shopify store, its API tokens and third-party apps are now as sensitive as the firmware. Expect demand for AppSec and SaaS-security engineers who lock down commerce stacks, rotate credentials and audit app permissions.

Marketing copy is now a liability. “We delete your shipping info in 180 days max” is a claim that regulators and class-action lawyers can test. Privacy counsel and compliance people who sign off on security claims before they’re posted will be in demand.

Physical security services are growing. Wrench-attack risk is driving hiring at firms selling executive protection, OSINT clean-up and anonymous shipping to crypto holders. If you can build privacy-preserving fulfilment, such as pickup lockers, burner addresses or zero-retention checkout, there’s a market for it.

---

The Bottom Line

Keystone sold privacy as a feature and took shots at competitors for keeping data forever. Now its own customers are posting breach emails about orders from years ago. Until Keystone publishes its report, assume your name and address are out there if you’ve ever bought one, and treat every “refund” or “replacement device” offer as an attack.

---

Want to build the privacy, AppSec and data-governance systems that would have made “we delete it” true? Browse open security and engineering roles on Cryptogrind →