Keystone Discloses Unauthorized Access to Website and Shopify API
TREE NEWS reports: Hardware wallet provider Keystone has confirmed that its official website was accessed without authorization on October 20, with a subsequent review of Shopify API activity on October 23 revealing that a third party obtained customer names, contact details, and shipping addresses. The breach did not compromise private keys or funds, but it exposed sensitive order information that could be exploited for phishing and physical targeting.
What Happened
Keystone detected the intrusion on October 20 and launched an investigation. By October 23, after auditing Shopify API logs, the company determined that an attacker had accessed customer data including names, phone numbers, email addresses, and delivery locations. The company has notified affected customers and advised them to be vigilant against unsolicited communications. Keystone emphasized that the incident was limited to e-commerce data and did not affect the security of its hardware devices or users’ private keys.
Industry Implications
The breach highlights a growing trend of attacks targeting the customer data of crypto hardware wallet manufacturers. While these devices are designed to keep private keys offline, the personal information stored by their vendors—such as shipping addresses and phone numbers—can be a goldmine for scammers. Attackers can use this data to craft convincing phishing emails or SMS messages, or even to conduct physical extortion. Similar incidents have affected other hardware wallet makers in recent years, underscoring the need for stronger data protection across the supply chain.
For Keystone, the incident may erode customer trust, especially among high-net-worth individuals who rely on hardware wallets for secure storage. The company will need to demonstrate transparency and invest in enhanced cybersecurity measures to regain confidence. The breach also serves as a reminder that security in the crypto ecosystem extends beyond on-chain protocols to the off-chain infrastructure and third-party services that support them.
Forward-Looking Perspective
As crypto adoption grows, hardware wallet vendors must treat customer data with the same rigor as private keys. This incident may accelerate the adoption of privacy-preserving practices, such as minimal data collection and encrypted storage, as well as the use of decentralized identity solutions. Regulators may also take a closer look at data protection standards in the crypto industry. Keystone’s response in the coming weeks will be critical in mitigating reputational damage and reinforcing its commitment to user security.
