Keystone confirms leak of customer names and shipping addresses; recovery phrases not exposed

Keystone, a maker of hardware wallets that keep private keys on a device offline, said a third party gained unauthorized access to its official website and obtained customer shipping information, according to a post on its official X account early on Oct. 25 Korean time. Names, contact details, shipping addresses and order details were exposed, while wallet recovery phrases, private keys and payment card data were not, the company said. Keystone apologized to customers and said it is notifying those affected by email.

Confirmed only after checking Shopify records

Keystone said it first detected the unauthorized access on Oct. 20. After checking API activity (the channel programs use to exchange data) with Shopify, the platform Keystone uses to run its online store, the company concluded on Oct. 23 that a third party had obtained customer shipping information. Three days passed between detection and confirmation.

Keystone replied to an X user's report before making its official announcement. At 2:08 p.m. KST on Oct. 24, it thanked the user on X and said it had "initiated an urgent investigation." About 13 hours later, at 2:59 a.m. KST on Oct. 25, it confirmed the leak. The company said it has blocked the access, fixed the vulnerability and opened an investigation. It did not say how many customers were affected and said a detailed report is coming soon.

What leaked and what did not

Keystone listed the exposed data as names, contact details, shipping addresses and order details, including items purchased and prices. Payment card and bank details, recovery phrases (seed phrases), private keys and wallet passwords were not exposed, it said.

Keystone warned that scammers holding the data may pose as the company by phone, text, email or mail, offering refunds, replacement devices or "fixes" for orders or addresses. "None of it is from us," the company said.

At least one customer has reported such a call. According to The Block, X user 'PEPE_Whale69' said a caller spoofing a Montreal police phone number asked whether Amazon, eBay or Keystone meant anything to them and had details matching a 2024 Keystone order. The same user had raised the possibility of a breach on X before Keystone did.

Was the 180-day deletion promise kept?

Keystone has marketed its handling of shipping data as a selling point. Its Privacy Promises page says, "All shipping information is automatically deleted 180 days after your order is placed," and that customers can ask for deletion right after delivery. On Jan. 5 this year, Keystone said on X that shipping data is permanently deleted 180 days after an order, and on March 8 it said that, unlike other hardware wallets, it deletes shipping information within 180 days at most.

The privacy policy issued under the name of Yanssie HK Limited, Keystone's operating company, last updated May 15, 2021, uses a somewhat different standard. It says order information is retained in line with Shopify's policy and that Keystone erases all order information of each customer "who has not made an order within the last 180 days."

According to The Block, one customer said on X they bought a device more than two years ago and still received a breach notification email, while another said 214 days had passed since their last order. The Block said it could not verify the claims, and Keystone has not yet said whether its 180-day deletion rule was followed. Keystone lists a Hong Kong address and names MetaMask, OKX Web3 Wallet and Zcash among its strategic partners.