Hardware wallet maker Keystone is facing questions about how long it retained customers’ personal information after disclosing that an unauthorized third party obtained names, contact details, shipping addresses and purchase records from its Shopify-powered online store. The security incident is confirmed by the company; claims that some exposed records should already have been deleted under its 180-day privacy pledge have not yet been independently established.
The distinction is central to the October 25 controversy. Keystone says no payment cards, bank details, recovery phrases, private keys or wallet passwords were exposed. But a dataset identifying people who bought cryptocurrency storage devices, where they live and what they ordered could give impersonators information for convincing follow-up scams. The manufacturer has not disclosed the number of affected customers or the oldest order included in the compromised information.
Keystone’s public-facing privacy promises say shipping details are deleted automatically 180 days after an order. Some customers now report receiving breach notices for purchases older than that period. The outstanding question is not merely how the intruder accessed the store; it is which customer records were still accessible, why, and whether the promised deletion process ran as described.
What did Keystone confirm about the Shopify store breach?
In an October 24 public statement, Keystone said it detected unauthorized access to its official website on October 20. It confirmed on October 23, after reviewing application programming interface activity with Shopify, that a third party had obtained customer shipping information. Its disclosure identified exposed records as names, contact information, delivery addresses, purchased products and prices.
Keystone said it blocked access, fixed the vulnerability, began investigating and was contacting affected customers by email. It warned that criminals could impersonate the company through calls, texts, emails or physical mail, perhaps claiming to arrange a refund, device replacement or address correction. It promised a more detailed incident report.
The initial statement did not quantify the affected customer population, identify the attacker, disclose the earliest exposed order or explain the intrusion method. It also did not say whether the affected records came directly from a live Shopify order database, an integrated application, an export or another accessible system. Those possibilities should not be collapsed into an assertion that Shopify’s underlying platform was compromised. The reference to Shopify API activity describes evidence reviewed during the investigation, not a published root-cause finding.
The confirmed exposure of shipping data is serious but different from a compromise of a hardware wallet’s cryptographic signing environment. The manufacturer says secret recovery credentials were not involved, and the available disclosure does not establish unauthorized transfers from customers’ wallets. The risk identified so far is exploitation of personal information, including fraud attempts that could lead a customer to reveal wallet credentials later.
Why is the 180-day deletion promise under scrutiny?
Keystone marketed limited retention as a privacy advantage. Its prominent privacy page tells buyers that shipping information is automatically erased 180 days after an order is placed and that they may request earlier deletion after delivery. That is an apparently straightforward promise tied to the date of a particular purchase.
However, the company’s current privacy policy, dated July 7, 2026, uses a different formulation. It says order information is erased for customers who have not placed another order within the previous 180 days. Under that wording, a subsequent purchase could reset the retention period for the customer’s information. The company has not explained how it reconciles this account-level rule with the order-level deadline on its marketing page.
A Keystone help-center article, updated in February 2023, further complicates the picture. It describes a customer-initiated deletion request for shipping information older than 180 days, says the procedure may take two to three weeks and states that Shopify handles final deletion. It also says records of city and country are retained. The article does not establish that customers were required to request deletion instead of receiving the automatic deletion advertised elsewhere, but it gives the company another process to clarify.
| Keystone source | Stated approach | Unresolved issue |
|---|---|---|
| Privacy Promises page | Automatic deletion 180 days after each order | Was it performed on the compromised records? |
| Privacy policy, July 2026 | Erase order information when a customer has made no order for 180 days | Do new orders extend retention of older purchases? |
| Help center, February 2023 | Request-based deletion, with Shopify processing and city/country retained | How does this process relate to automatic erasure? |
The latest policy separately describes six-month retention for inactive support tickets and a longer retention framework for newsletters and certain AI-assistant interactions. Those distinctions matter: receiving a company’s email after two years would not by itself prove that a two-year-old shipping address remained in the dataset taken by the intruder. A notification address, support contact and complete old order are different categories of evidence.
What are customers alleging about orders older than 180 days?
According to reporting published October 25, several people on X questioned Keystone’s retention practices after the disclosure. One account said it had purchased a device more than two years earlier and still received a breach notification. Another said 214 days had elapsed since its last order. These are attributed customer accounts, not verified evidence of a deletion failure.
A third user alleged that someone impersonating a Montreal police officer had called and cited details matching a Keystone purchase made in 2024. The customer raised the concern before Keystone’s public breach announcement, and the company replied that it had begun investigating. But the caller’s claimed knowledge has not been independently verified, and the available evidence does not establish that this particular call originated from the newly disclosed breach rather than another source of personal data.
The claim about 214 days since the last purchase, if documented and linked to actually exposed shipping records, would be especially material because it could raise questions under both the order-based pledge and the current policy’s customer-based formulation. That condition has not yet been established. Investigators would need the relevant purchase histories, the actual fields exposed, evidence that a record was present when the attacker accessed it, and corresponding deletion logs.
Keystone has not publicly provided the age distribution of the leaked orders or a technical explanation for the reported older-record cases. The reports therefore warrant scrutiny rather than a conclusion that the company knowingly retained data contrary to its promises.
Why do shipping records create risk without leaked private keys?
A hardware wallet separates crypto signing credentials from many internet-facing services, but its buyer may still be identifiable through the company’s online store. A stolen record containing a customer’s name, address, phone or email, purchased model and price gives an impersonator convincing details. The scammer may not have the keys, but can try to persuade the owner to surrender them.
For example, an unsolicited message that quotes the buyer’s order and offers a security replacement could appear more credible than a generic phishing email. The victim might be directed to a fake portal to enter a recovery phrase, to install unsafe software, or to use a device delivered by the attacker. These are plausible attack paths rather than confirmed consequences of this particular breach.
There is precedent for the mechanism. In September, a Trezor-themed phishing campaign used a supposed security warning and a file designed to capture recovery phrases. DaveFinances also reported that a breach at email provider Brevo affected multiple cryptocurrency firms, illustrating how information held outside a device manufacturer can become part of an attack chain. These were separate incidents and should not be mistaken for proof of how Keystone was breached.
Disclosure of a home address introduces a physical-security concern as well: a criminal might infer that the resident holds cryptocurrency. That does not establish that any Keystone customer has suffered a physical attack, or reveal the balance stored in any wallet. An order record shows a product purchase, not the value of assets secured with the device.
What should affected wallet owners do now?
Keystone customers should navigate directly to official support channels rather than opening unexpected links from emails or messages claiming to discuss the breach. They should not share a recovery phrase, private key or wallet password with anyone offering refunds, device replacements, support or verification. No legitimate investigation of shopping records requires customers to enter the secret phrase controlling their cryptoassets.
People who receive an unsolicited replacement wallet should not initialize it simply because the sender knows their address or order number. Owners who have only had their contact details disclosed do not necessarily need to transfer funds to a new wallet or rotate an otherwise protected recovery phrase. Moving assets under pressure from an impersonator can introduce additional risk. The decision changes if a secret phrase was actually revealed or malicious signing was authorized.
For a more detailed decision process, DaveFinances’ guide to recognizing wallet phishing and malicious signing requests distinguishes an unsolicited message, a simple wallet connection, an approval and an exposed recovery phrase. Customers can also ask Keystone what specific records it held, whether their shipping data was deleted, what systems were involved and how to exercise their available privacy rights.
What must Keystone establish in its incident report?
The promised follow-up should answer two distinct questions. First, how did an outsider gain access, what data was extracted, over what period, and how many people and countries were affected? Second, did Keystone’s deletion program work in practice, and did its website, Shopify-linked systems or other providers retain customer identifiers longer than buyers reasonably understood?
A useful account would separate total orders accessed from unique customers, show the oldest affected order and disclose how many records exceeded 180 days at the time of access. It would describe whether records were deleted, anonymized, archived or copied into other services, and explain any legally required retention exceptions. Evidence of deletion logs and independent review would be more informative than repeating the retention policy.
The business issue extends beyond immediate theft. A hardware wallet is sold partly on a promise of minimizing trust. A buyer may accept the security of offline keys while remaining vulnerable to a vendor’s shopping systems, marketing providers and support databases. The reputational cost for Keystone will depend not only on the eventual breach count but also on whether the company can reconcile its 180-day message with what investigators find in the exposed records.
Investor takeaway: Keystone has confirmed a customer-information breach, not a direct compromise of wallet private keys. Claims that data from orders older than 180 days was involved remain unverified. The company’s incident report, deletion records and explanation of its differing retention statements are the next facts to watch.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574