Keystone hardware wallet’s official website suffered unauthorized access, with customer shipping information obtained by a third party
BIBIBI
AT A GLANCE
Keystone said its official website suffered unauthorized access, and customer names, contact information, addresses, and order details were obtained.
Article
Keystone hardware wallet’s official website suffered unauthorized access, exposing users’ names and shipping addresses
PANews October 25 reported that hardware wallet Keystone posted on X that it October 20 discovered unauthorized access to its official website and, after verifying API activity with Shopify,October 23 confirmed that a third party had obtained customers’ shipping information. The exposed data included names, contact information, shipping addresses, and order details (products and prices); payment card or bank information, seed phrases, private keys, and wallet passwords were not exposed. Keystone stated that it has blocked the access, remediated the vulnerability, and launched an investigation, and is notifying affected users by email. It also warned users to remain alert for scams by individuals impersonating Keystone via phone calls, text messages, emails, or letters under the pretext of refunds or device replacements, and never provide seed phrases or private keys to anyone.
Keystone said it October 20 discovered unauthorized access to its official website.
02
Keystone said that after verifying API activity with Shopify, it October 23 confirmed that a third party had obtained customers’ shipping information.
03
The exposed data included names, contact information, shipping addresses, and order details (products and prices).
04
Payment card or bank information, seed phrases, private keys, and wallet passwords were not exposed.
05
Keystone stated that it has blocked the access, remediated the vulnerability, and launched an investigation, and is notifying affected users by email.
06
Keystone reminded users to beware of scams impersonating it involving refunds or device replacements, and not to provide seed phrases or private keys to anyone.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This is a website customer-data breach incident. The disclosed information involves identities, contact information, addresses, and order contents; the materials state that payment information and wallet security credentials were not exposed.
Why it matters to readers
The exposed customer data may be used by impersonators posing as official representatives for phone, text message, email, or letter scams; users should be particularly wary of contacts requesting seed phrases or private keys.
If you are a Keystone user, be wary of contacts claiming to offer refunds or device replacements, and never disclose your seed phrase or private key.
Risks and unknowns
The materials do not specify the number of affected users or the exact time frame.
The materials do not specify the root cause of the vulnerability.
The provided material is PANews’ account of Keystone’s statement on X and does not include Keystone’s original post or Shopify’s verification record.
The materials do not confirm whether scams impersonating Keystone or user asset losses have already occurred.
Related Developments
Loading event timeline…
Related concepts
API
This term is not in the glossary yet. Browse related concepts in the glossary.
