Keystone Wallet Data Breach: What Leaked and What to Do Now
Keystone says a third party took customer shipping data and the key its devices use to prove they are genuine. What leaked, the risks and a 9-step plan.
Key takeaways
- Keystone says customer names, contact details, shipping addresses and order details leaked. In an October 26 update, it said the attacker also took the key its devices use to prove they are genuine.
- As reported, Keystone says a device delivered before October 20 that passes its authenticity check can be used normally. A device received after October 20 should not be used until Keystone support confirms it is genuine.
- Keystone says seed phrases, private keys, wallet passwords and payment data were not compromised. The main danger is believable scams, and a fake replacement device is now the most serious of them.
- Never enter a recovery phrase into a device you did not order. Never type your seed phrase into any website, app, form, call or chat.
- The video says moving coins does not fix an address leak and is usually only needed if your seed phrase may have been exposed. Keystone owners should first check when their device arrived.
Keystone, the hardware wallet maker, says a third party obtained customer names, contact details, shipping addresses and order details after it detected unauthorized access to its website on October 20, 2026. In a later statement on October 26, Keystone said the attacker also took the key its devices use to prove they are genuine.
That matters for anyone who owns a hardware wallet. Keystone says recovery phrases, private keys and payment details were not compromised. But a stolen device key means a fake replacement device could pass Keystone’s authenticity check. Combined with names and home addresses, that makes convincing scams the main risk. The video sets out what to watch for and a step-by-step response.
What did Keystone confirm about the breach?
Keystone confirmed that an unauthorized third party obtained customer shipping information. In a notice posted on its X account on October 24, 2026, the company said it detected unauthorized access to its website on October 20. It confirmed the data exposure on October 23, after reviewing API activity with Shopify, the online store platform. That first notice did not say when the access began.
The video is careful on one point: Keystone did not say Shopify caused the breach. Shopify was only part of how Keystone checked the activity.
According to Keystone’s first notice, the exposed data included:
- Customer names
- Contact details
- Shipping addresses
- Order details, including the items bought and the prices paid
Keystone said it blocked the access, fixed the vulnerability, opened an investigation and started emailing affected customers.
The video works from that first notice. Keystone said more on October 26, and reports since then fill in details the video lists as unknown:
- How many buyers were affected. Reports disagree. The Hacker News reported 25,964 buyer records from purchases made between 2024 and 2026. BitPinas reported more than 38,000 buyers. Keystone’s own statement is the place to check the figure.
- Which contact details were taken. BitPinas reported that phone numbers and email addresses were taken.
- How old the data was. The Block reported that customers who ordered more than two years ago received breach notices. Keystone had said it would delete shipping data after 180 days.
Is my crypto safe after the Keystone breach?
Keystone says the leak did not expose recovery phrases or private keys, but its October 26 update adds a separate risk for recently delivered devices. The company said payment cards, bank details, recovery phrases, private keys and wallet passwords were not compromised.
That claim fits how hardware wallets work. Your seed phrase is the list of words that controls your coins. It is generated on the device and is meant to stay offline, so a store website has no reason to hold it. For a refresher, here is what a seed phrase is and how to store it safely.
The device key changes the picture. According to The Hacker News, Keystone said the attacker obtained the key its wallets use to prove they are genuine. A fake device could therefore pass Keystone’s authenticity check. As reported, Keystone’s guidance depends on when your device arrived:
- Delivered before October 20 and passes the authenticity check: use it normally.
- Received after October 20: don’t use it until Keystone support confirms it is genuine.
BitPinas also reported that Keystone stopped shipping and destroyed 18,835 unsold devices.
The video uses a simple comparison. Your wallet is a safe in your home. The leak is a list of which homes have safes and what each safe cost. That list doesn’t open any safe. But it tells a criminal where to knock and what to say when they do. In the video’s words, the lock wasn’t picked; the address book was. The October 26 update adds one more concern: someone may be able to pass off a convincing copy of the safe.
Has this happened to other wallet makers?
Yes. The video points to two earlier cases with the same pattern: contact details leaked, but not seed phrases.
| Company | When | What leaked | What the company said was safe |
|---|---|---|---|
| Ledger | 2020 (posted on a hacking forum in December) | Names, physical addresses and phone numbers from 272,853 orders, per reports | No financial information or recovery phrases, according to the video |
| Trezor | August 2026 (breach at shipping partner ShipMonk) | Names, emails, phone numbers and shipping addresses. Reports counted about 14,000 customers at first and about 81,000 after a September update | Its own systems, devices, private keys and wallet backups |
| Keystone | October 2026 | Names, contact details, addresses and order details, plus the device authenticity key per the October 26 update | Recovery phrases, private keys, passwords and payment data |
According to the video, Ledger warned in 2020 that scammers could use the data for phishing by email and text. The video says that warning is the real lesson. Coins weren’t taken through the leak itself. The harm came later, from people using the data to look believable.
What are the real risks from a shipping-data leak?
The video names four risks, all human rather than technical. Since Keystone’s October 26 update, the second one, a fake replacement device, is the most serious for Keystone customers.
1. Phishing emails and texts. Phishing means messages that pretend to come from a trusted company to trick you into clicking or sharing details. Criminals know you bought a hardware wallet, so they can write messages that sound right: a security problem with your device, a refund you’re owed, an urgent update. Keystone itself warned that scammers could pose as its representatives. It said they might offer refunds, replacement devices or help with orders and shipping addresses.
2. A fake replacement device in the mail. A box arrives looking official, perhaps with a note saying your old device was affected. You set it up, and it shows you a recovery phrase or asks you to type one in. If the device was tampered with, or is just a screen showing a fake setup page, whoever built it can end up with your phrase. The video says Keystone told customers never to enter a recovery phrase into a device they did not order. With the authenticity key reported stolen, a fake device could pass Keystone’s check. That is why Keystone’s reported guidance asks owners of devices received after October 20 to wait for confirmation from its support team.
3. Social engineering by phone. A caller says they’re from support and knows your name, address and what you paid. That sounds real, but it isn’t proof. Knowing your details is not the same as being the company. BitPinas’s report that phone numbers were taken makes this risk more relevant.
4. Physical risk. A list tying names and home addresses to crypto purchases can raise physical safety concerns. The host stresses this is not a prediction that anything will happen. The point is only that your address is less private than you thought. Bullrunners has covered how data leaks feed wrench attacks and home invasions in more detail.
What to do now: the 9-step plan
For Keystone owners, checking when your device arrived comes first, as described above. After that, the video’s general response plan is deliberately simple:
- Don’t click anything in an unexpected message. That means no links, attachments or QR codes.
- Go to the company yourself. Type the official website address into your browser or use a bookmark you saved before the incident. Look for the notice there, not through a link in an email or text.
- Never type your seed phrase anywhere. That includes websites, apps, forms, calls and chats. No real support team needs it, and anyone who asks is a scammer.
- Ignore any replacement device you didn’t order. Don’t plug it in or set it up. Keep it or throw it away, but don’t use it.
- Consider a passphrase. Many hardware wallets let you add an extra word or phrase on top of your seed. A passphrase can still protect the wallet if someone gets the seed. The catch: if you forget it, nobody can recover it. Write it on paper, store it separately from your seed, and read your device maker’s own guide first.
- Ship future orders elsewhere. Use a post office box, a trusted friend or a business address you’re comfortable with. Consider whether your name needs to be on the order, if the seller allows it. The checks in how to buy a hardware wallet safely still apply.
- Talk less in public. Don’t post holdings, wallet details or delivery photos online.
- Check whether your email appears in known breaches. Free tools such as Have I Been Pwned let you search your address. If it shows up, change that account’s password and turn on two-factor authentication.
- Consider a credit freeze if more personal data came out than a shipping address. In the United States, you can place one for free with the credit bureaus. A freeze makes it harder for someone to open accounts in your name.
Should you move your coins?
For this kind of leak, based on Keystone’s first notice, the video’s answer is usually no. Moving coins doesn’t change your home address and doesn’t fix the leak. Your seed phrase controls your coins. If it was never exposed, the video says a new wallet doesn’t make you safer from this problem.
The video says the answer changes if you think your seed phrase was exposed. Its examples:
- You typed it into a website or app.
- You set up a replacement device you didn’t order.
- You photographed it and stored the picture online.
In that case, the video says to treat the old seed as compromised. Create a new seed on a device you trust, bought from the official maker, checked to be sealed and set up fresh. Then move funds across in small amounts first and check each one. This guide to sending a crypto test transaction describes the same approach.
The video was made before Keystone’s October 26 update, so it doesn’t cover the stolen device key. If your Keystone device arrived after October 20, Keystone’s reported guidance is to stop using it until support confirms it is genuine. A device that cannot be confirmed fits the video’s description of a device you shouldn’t trust with your seed.
What to watch next
Go to Keystone’s official site by typing the address yourself, and read its October 26 statement directly. Check three things: the number of affected buyers, since press reports disagree; the exact steps for verifying a device; and whether Keystone has said anything more about data it kept past its stated 180-day limit.
If phone numbers and emails were taken, as BitPinas reported, expect more scam calls and texts that mention your order. In the meantime, the video’s defense is boring on purpose: don’t click, go to the official site yourself, never type your seed anywhere, ignore the mystery box and keep your details quiet.
Frequently asked questions
What happened in the Keystone hardware wallet breach?
Keystone said on October 24, 2026 that it detected unauthorized access to its website on October 20. It confirmed on October 23 that a third party had obtained customer names, contact details, shipping addresses and order details. In an October 26 update, Keystone said the attacker also obtained the key its devices use to prove they are genuine.
Were Keystone seed phrases or private keys stolen?
Keystone says no. The company said recovery phrases, private keys, wallet passwords, payment cards and bank details were not compromised. However, the stolen authenticity key means a fake device could pass Keystone's check, which puts recently delivered devices at risk.
Is my Keystone device safe to use?
According to reports of Keystone's October 26 statement, a device delivered before October 20 that passes the authenticity check can be used normally. A device received after October 20 should not be used until Keystone support confirms it is genuine.
How many Keystone customers were affected?
Reports disagree. The Hacker News reported 25,964 buyer records from purchases made between 2024 and 2026, while BitPinas reported more than 38,000 buyers. Check Keystone's own statement for its figure.
Should I move my crypto after the Keystone leak?
The video says usually not, because moving coins does not change your home address or fix the leak. It says moving makes sense if your seed phrase may have been exposed, for example if you set up a device you did not order. The video works from Keystone's first notice. Owners of devices received after October 20 should follow Keystone's verification step first.
Full video transcript
From the video's captions, lightly formatted. Captions can mishear names and numbers, so check figures against the article above.
A hardware wallet maker just told its customers that a third party got their names and home addresses. If you own a hardware wallet, you need to hear what that does and what it does not put at risk. The short version is this. Your seed phrase was not on that website, but your home address was. And that changes what you should watch for over the next few weeks.
But here is the plan. First, the confirmed facts, then what leaked and what did not. Then real risks, then a step-by-step list of what to do now. and at the end when moving your funds makes sense and when it does not. All right, ball runners, let's start with what happened. [music] On October 24th, 2026, Keystone, the hardware wallet maker, posted a notice on its ex account. It said its website was accessed without authorization October 20th.
Keystone said that it confirmed on October 23rd that a third party had obtained customer shipping information. It said it reached that conclusion after reviewing activity with Shopify, the online store platform. Now, I want to be careful here. Keystone did not say Shopify caused this. We are only reporting that Shopify was part of how Keystone checked the activity.
And according to Keystone, the data included customer names, contact details, shipping addresses, and order details, including the items bought and the prices. Keystone said it blocked the access, fixed the vulnerability, opened an investigation, and started emailing affected customers. It also said a detailed report is coming, but what we do not know yet matters too. Keystone has not said how many customers were affected. And the reports I found do not say which contact details were taken.
For example, whether phone numbers were included as well. Now, the part everyone asks about first, is my crypto safe? Now, Keystone says payment card and bank dials were not compromised. It also says recovery phrases, private keys, wallet passwords were not compromised, too. Now, that fits how a hardware wallet works.
Your seed phrase is generated on the device. It's meant to stay offline. A store website has no reason to hold it. Just think of it like this. Your wallet is in a safe in your home.
The leak is a list of which homes have safes and what the safes cost, but that list does not open any safe, but it tells a criminal where to knock and what to say when they do. So, the lock was not picked, but the address book was. And that is what I want you to focus on because the danger here is not technical, it's human. Now, this is not the first time a wallet company's customer data has come out. In 2020, Ledger had a customer data leak.
The data was posted on a hacking forum in December of that year. Reports at the time counted over 270,000 physical addresses and phone numbers. Ledger said no financial information and no recovery phrases were exposed. It also warned that scammers could use the data for fishing by email and text message. And that warning is the point.
The coins were not taken from the leak itself. The harm came later from people using the data to look believable. Now, more recently, in August 2026, Treza said a breach at his shipping partner exposed customer names, emails, phone numbers, and shipping addresses. Treor said its own systems were not compromised and that devices, private keys, and wallet backup stayed secure. Now, that's the same pattern.
The seed is not the leak. the contact details are. So, what does a criminal do with a name, an address, and a list of what you ordered? Risk number one is fishing emails and texts because they know you bought a hardware wallet. They can write a message that sounds right. It might say there is a security problem with your device.
It might say you are owed a refund. It might say you must update something today. Keystone itself warned about this. It said scammers could pose as Keystone representatives and offer refunds, replacement devices, or help with orders and shipping addresses. Risk number two is a fake replacement device in the mail.
Now, this one is worth slowing down for. Someone sends you a device in a box that looks official. Maybe with a note. It says your old one was affected, so use this new one. You set it up, it shows you a recovery phrase and asks you to type one in.
Now, if that device was tampered with, or if it is only a screen showing a fake setup page, then whoever built it can end up with your phrase. Keystone told customers never to enter a recovery phrase into a device they did not order. And that is exactly why. Risk number three is social engineering by phone. For example, a caller says they are from support.
They know your name, your address, even what you paid. Now, that sounds real, but it is not proof. Knowing your details is not the same as being the company. So, never let a caller's knowledge be the thing that convinces you. Risk number four is physical risk.
Now, I do not want to scare you, but I'll be honest. A list of name, home addresses, and purchase details tied to crypto is the kind of information that can raise physical safety concerns. Now, I'm not saying it will happen. I'm saying that your home address is now less private than you thought. So, it is reasonable to think about it calmly and take the sensible steps.
So, here is the step-by-step list. Step one, do not click anything in an unexpected message. Not a link, not an attachment, not a QR code. Step two, go to the company yourself. Type the official website address into your browser or use a bookmark you made before the incident.
Look for the notice there and do not use a link from an email or even a text. Step three, never type your seed phrase anywhere. Not into a website, not into an app, not into a form someone sends you, not into a call or even a chat. No real support team needs it, and anyone who asks for it is a scammer. Step four is ignore any replacement device that shows up in the mail.
If you did not order it, do not plug it in and do not set it up. Keep it or just simply throw it away, but do not use it. Step five, think about a passphrase. Now, many hardware wallets let you add an extra word or phrase on top of your seed. If someone ever got your seed, the passphrase can still protect that wallet.
But there is a catch. If you forget it, no one can recover it for you. So, write it down on paper and store it separately from your seed and read your device maker's own guide first. Step six, for future orders, ship to a different address, a post office box, a trusted friend, or a business address you are comfortable with. Think about whether your name needs to be on the order, too, if the seller allows it.
Step seven, talk less in public. Do not post your holdings, your wallet, or your delivery photos online. The less strangers know, the fewer reasons they have to target you. Step eight, check whether your email shows up in a known breach. Free tools like, "Have I been porned?" let you search your email address.
If it shows up, change the account's password and turn on two factor authentication. Step nine. If more personal data came out than just a shipping address, consider a credit freeze. Because in the United States, you can place one for free with the credit bureaus. It makes it harder for someone to open new accounts in your name.
Now the question I expect in the comments, should I move my coins? Now for this kind of leak based on what Keystone has said, the answer is usually no. The reason is simple. Moving your coins does not change your home address and it does not fix the leak. Your seed phrase is the thing that controls your coins.
If your seed phrase was never exposed, a new wallet does not make you safer from this particular problem. When would it be different? If you think your seed phrase was exposed, for example, you typed it into a website or an app, or you set up a replacement device you did not order, or you photographed it and stored the picture online, in that case, treat the old seed as compromised. Create a new seed on a device you trust, brought from the official maker, and check that it is sealed and set up fresh. Then move those funds across in small test amounts first, and check each one.
Right now, let me put this together for you. The risk now is believable scams, fake emails, fake texts, fake replacement devices, and even fake support calls and a small but real physical safety concern. The defense is simple and it is boring. Do not click. Go to the official site yourself.
Never type your seed anywhere. Ignore the mystery box and keep your details quiet. Now, one last thing. When a story like this hits, most people ask one thing. Is my crypto set up the right way?
Now, if you want a second pair of eyes on that, here is what to do. Click the first link in the description and book your free portfolio review. And here is how it works. Our team looks at how your crypto is set up. That means where it is held and how it is organized.
You never reveal your private keys or your seed phrase. Never. We will not ask for them. And you should never give them to anyone. You keep full custody the whole time.
Your coins stay where they are. And we do not need to see how much you have. Reviews are for adults 18 and over. So that is the link, the first link in the description. Click it and book your free portfolio review.
This video is for educational commentary only. It is not financial advice. Thanks for watching Bull Runners. I will see you in the next one.
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures and quotes are as reported in the video on November 4, 2026 and may have changed since.
