Keystone discloses Shopify-tied data breach; customers say leaked orders predate the 180-day deletion

Hardware-wallet maker Keystone disclosed on Saturday, October 24, 2026 that an attacker accessed customer data on its Shopify-powered online store. The company says it detected unauthorized access on October 20 and, after an October 23 check of API activity with Shopify, confirmed that a third party had obtained names, contact details, shipping addresses, and purchase and payment amounts. Keystone says payment-card and bank details, recovery phrases, private keys and wallet passwords were not exposed. The Block carried the disclosure; Keystone has not published a count of affected customers or an explanation of the attack vector.

The 180-day deletion gap

The dispute between Keystone's public policy and what customers now say was in the stolen data is the specific story:

• Keystone's X disclosure and its Privacy Promise page state: "180 days after your order, your shipping data is permanently deleted."
• Keystone's privacy policy, last updated May 2021, uses softer wording about "order information for customers who have not ordered within the last 180 days," and a help-centre article says city and country records are kept and that Shopify handles final deletion.
• Affected customers on X say the exposed orders are older than 180 days; one reports a 214-day-old order was in the leaked set.
• One user reported a caller spoofing a Montreal police number social-engineering them with details that matched a 2024 Keystone order — the first visible sign a customer had of the breach, and before Keystone itself disclosed.

Keystone has not said whether it followed its stated deletion policy. The Block says it could not independently verify the age of individual exposed orders.

What's confirmed vs. unconfirmed

Confirmed:

• Unauthorized access via the Shopify storefront, detected Oct. 20, verified Oct. 23 against Shopify API logs, disclosed Oct. 24.
• Shipping-and-order data exposed: names, contact details, shipping addresses, product line items, amounts paid.
• Keystone is emailing affected customers.

Unconfirmed:

• The number of affected customers.
• The attack vector into the Shopify store.
• Whether seed-phrase or wallet data was ever accessible via the breached endpoints.
• Whether the leaked records breach Keystone's own retention commitment.

Pattern: sixth cold-wallet brand with a 2026 customer-data event

Keystone is the sixth cold-wallet vendor to confirm a customer-data event in 2026, per Cointribune's tally:

• Ledger — Global-e e-commerce leak (notified Jan. 5) and, far more severely, the CryptoBilis reseller shipping devices with hardware implants that captured recovery phrases during setup (Oct. 10). On-chain researchers put the implant losses above $86M.
• Coldcard — a seed-generation flaw disclosed July 30 that let attackers reconstruct keys; roughly $116M in BTC attributed to the exploit.
• Trezor — email leaks via third-party providers ShipMonk (Aug. 13) and Brevo (Sep. 10); 427,000-plus addresses exposed.
• SafePal — order-tracking flaw (Aug. 16) exposing 39,798 customer records.
• BitBox — email theft via the Brevo subcontractor (Sep. 24), fuelling targeted phishing.
• Keystone — this week's Shopify event.

Four of the six (Keystone, Ledger-Global-e, Trezor-Brevo/ShipMonk, BitBox-Brevo) are third-party storefront or marketing-platform compromises, not device-level flaws. Keystone's own position — that the recovery phrase is generated on-device and never leaves it — remains intact; the attack surface here is who ships the box, and who keeps the shipping record.

What to watch

1. Keystone's attack-vector post-mortem. Shopify stores are breached by API-key leaks, admin-account takeovers, malicious apps and theme-level stolen credentials. Which of those was in play determines whether other Shopify-hosted hardware vendors are also at risk.
2. Reconciliation of the 180-day retention claim. If 200-plus-day-old orders were in the stolen set, Keystone owes an audit note on whether the deletion runs on the Shopify side (per its help-centre text) or on Keystone's side (per its Privacy Promise).
3. Downstream phishing waves. The Trezor-Brevo and BitBox-Brevo precedents produced targeted recovery-phrase phishing within days of disclosure. Keystone customers should assume the stolen data is already in the hands of a social-engineering operator by the time it is sold.
4. A legible consolidated advisory. Six brands in ten months, five of them via third-party providers, is a pattern that invites a unified industry disclosure of vendor-of-record retention norms. None exists today.

Action checklist

1. If you ordered from Keystone's online store at any point, assume your name, physical address, phone number and order detail are in a stolen set.
2. Decline unsolicited "verification" calls, including those appearing to come from local police — the Montreal-spoofed call pattern is already in use.
3. Never type or speak your recovery phrase to anyone, including a caller claiming to be Keystone support, a shipper, or law enforcement.
4. If a device arrives in packaging you did not order or that shows tamper evidence, do not initialize it — set it up only from a sealed, verified-vendor device.

Sources:

• The Block — Keystone customers say breach exposed data the hardware wallet maker promised to delete (primary, 2026-10-25).
• Cointribune — Hack Ledger, Coldcard, Keystone… La fin des Cold Wallets crypto ? (2026-10-25).