Hardware wallet maker Keystone has confirmed that unauthorized actors accessed customer shipping information through its online store, prompting warnings across the cryptocurrency community, including from Dogecoin holders, to watch for impersonation scams. No recovery phrases, private keys or payment details were exposed, but names, addresses and order histories were compromised, raising concerns about targeted phishing campaigns.
What Happened and When
Keystone said it detected unauthorized access to its official website on October 20, 2026. After examining API activity connected to its Shopify-based storefront, the company confirmed on October 23 that a third party had retrieved customer shipping records. In a public statement posted to X, Keystone apologized directly to affected users: "You trusted us with those details, and we're sorry we didn't keep them safe."
The exposed dataset reportedly includes customer names, contact information, shipping addresses, and details about items and prices in past orders. Keystone emphasized that no wallet recovery phrases, private keys, wallet passwords, or financial account information were part of the breach. The company says it has closed the vulnerability that allowed the access, halted further exposure, and opened an internal investigation, with a fuller incident report expected and direct notifications going out to impacted customers.
Why Shipping Data Matters for Crypto Owners
Keystone's devices store cryptographic keys for assets including Dogecoin (DOGE), Bitcoin (BTC), Ethereum (ETH) and Solana (SOL). Because purchasing a hardware wallet already signals that a customer holds digital assets, a leaked shipping address can effectively flag that person as a potential target for scammers, even without any financial credentials being exposed. Keystone warned that bad actors may now impersonate the company by phone, text, email or physical mail, offering fake refunds, replacement devices, or "fixes" tied to the breach. The company stressed, "None of it is from us," and reiterated that it will never request a customer's recovery phrase or ask them to enter it into an unfamiliar device.
Community Response and Precautions
Dogecoin community figure Mishaboar amplified the warning on X, noting that similar data exposures have previously affected hardware wallet makers Trezor and Ledger, often followed by waves of targeted phishing attempts. "Expect targeted phishing emails, texts, phone calls. Possibly even physical mail," Mishaboar wrote, adding that a buyer's home address may now be associated with crypto ownership.
- Never share a recovery phrase or private key with anyone, under any circumstance.
- Do not enter a recovery phrase into a device you did not personally order or set up.
- Avoid clicking links in unsolicited emails, texts or messages referencing the breach.
- Verify any communication only through Keystone's official channels.
- Limit sharing personal or family details on social media that could aid scammers.
Security specialists generally advise that legitimate hardware wallet providers never ask customers to disclose recovery phrases or install software from unverified sources, a principle that remains central to protecting crypto holdings even when peripheral data like shipping details is compromised.