Keystone told hardware-wallet buyers their shipping information would be deleted 180 days after an order. Following an October 2026 customer-data breach, some buyers say information tied to much older purchases may have been exposed.
The claims are not yet independently proven. But a BlockBriefing review of Keystone’s public privacy promise, its current privacy policy and its customer-support FAQ finds three different descriptions of how the company handles order data. The distinction matters because a hardware-wallet purchase can link a real name and home address to ownership of a device used to store crypto.
Keystone has acknowledged the theft of names, contact information, shipping addresses, and purchase details from its online store. It says recovery phrases, private keys, wallet passwords, and payment-card or bank details were not exposed. Update (October 27): In a further disclosure on October 26, Keystone said a vulnerability in a third-party monitoring tool exposed personal information in 25,964 purchase records from 2024–2026 and 12,873 incomplete checkout records. The company also disclosed the theft of a device-authentication key and said it would destroy 18,835 unsold devices containing that key. These figures and the cause are attributed to Keystone’s updated statement, rather than an independently completed forensic examination. The Block reported the disclosure and the older-order allegations on October 25.
This investigation compares publicly available policies with Keystone’s breach statement and reported customer accounts. BlockBriefing has not examined the stolen database or independently authenticated the affected buyers’ messages.
What Keystone says happened on October 20
Keystone said it detected unauthorized access to its official website on October 20, 2026. After checking application programming interface activity related to Shopify, which powers its store, the company confirmed on October 23 that an outside party had obtained customer information. Keystone disclosed the incident publicly on October 24 through its official X account.
The company said it had stopped the access, fixed the vulnerability, started an investigation and begun emailing affected customers. It warned that scammers could impersonate Keystone staff using emails, telephone calls, text messages or physical mail to offer refunds, replacements or supposed fixes.
The reference to Shopify API activity does not establish that Shopify itself was compromised. In its October 26 follow-up, Keystone attributed the intrusion to a vulnerability in a third-party data-monitoring tool that gave an attacker elevated privileges. The company also said its automated deletion process had not reliably completed some requests. Independent technical details about the full attack path remain limited.
The 180-day promise is not worded the same way everywhere
Keystone has promoted data deletion as an advantage for customers concerned about privacy. Its public Privacy Promises page says that all shipping information is deleted automatically 180 days after an order is placed. It also advertises the option of requesting earlier deletion once a device has been delivered.
Read on its own, that statement suggests a deadline tied to each individual order.
The company’s Privacy Policy, marked updated July 7, 2026, describes something different. It says Keystone erases order information for customers who have not placed another order within the preceding 180 days. That wording appears tied to a customer’s recent buying activity, not necessarily the date of each record. Whether it produces a different deletion outcome in practice is not explained.
A third account appears in Keystone’s support FAQ. Under instructions for deleting shipping information, the page describes a request process that may take two to three weeks. It says city and country details are retained, and that Shopify handles the final deletion process. The FAQ does not, by itself, demonstrate what happened to any record in the breach.
These differences are verifiable in Keystone’s own published materials. They do not prove a retention violation. They do show why a precise explanation of the deletion process is now necessary.
Customers describe older orders, but the records have not been verified
The Block reported that several customers publicly questioned the promised retention period. One said they received a breach notification despite having purchased a Keystone device more than two years earlier. Another claimed their last order predated the incident by 214 days.
A separate X user said someone impersonating police knew details that matched a 2024 Keystone order. That account raises a serious concern about targeted social engineering. It does not establish that the caller obtained the information from this particular incident.
The Block said it could not verify the users’ claims. BlockBriefing has likewise not authenticated their purchase dates, notification emails or the underlying records. A customer receiving an alert may not be evidence that a particular old order entry was extracted; the notification could reflect other retained information or a wider contact list.
Keystone’s October 26 update confirms that records from 2024–2026 were affected and acknowledges that failed automated deletion tasks left certain personal information stored longer than its 180-day policy allowed. It says it is reducing its retention period to 90 days. Questions remain about the exact records associated with individual customer complaints, third-party copies, and whether all pending deletion requests have been completed.
A secure wallet can still leave its owner exposed
For a clearer distinction between device security and personal-data security, read our guides to hot and cold wallets and protecting a recovery phrase.
Hardware wallets are designed to protect signing keys. They do not automatically protect the information provided at checkout.
Someone who has a buyer’s name, home address and exact product can write a convincing fake support message or letter. A criminal may invent an urgent firmware issue, a replacement-device program or a delivery problem to persuade the buyer to reveal a recovery phrase. Exposure of physical addresses can also present personal-safety concerns.
This does not mean Keystone customers’ coins were stolen or that its hardware wallets were remotely compromised. Keystone says wallet credentials were not among the exposed data, and no evidence reviewed here contradicts that specific statement. The security concern is the information that could make later fraud more credible.
What Trezor and SafePal disclosures show
The retention question reaches beyond Keystone. In an official September 4 update, Trezor said a breach at shipping partner ShipMonk included records of approximately 67,000 additional US customers from purchases between 2019 and 2021. Trezor said it had repeatedly requested deletion and received written assurances that the data was removed, but the partner had kept it.
That is a documented example of an old-order retention problem. It is not proof that Keystone experienced the same failure or used the same vendor.
Separately, SafePal disclosed on August 16 that an authorization flaw in an order-tracking integration exposed details linked to approximately 39,798 customers. In response, SafePal said it shortened its sensitive order-data retention period to 90 days, while retaining a secured offline copy of incident-related records for possible investigations.
These cases involved distinct companies and disclosed mechanisms. No public evidence connects their attackers. Together they show how fulfillment, support and store systems can create risks that are separate from the security of the devices sold.
Five questions that would settle the Keystone dispute
- How old were the exposed records? Keystone’s October 26 update placed affected purchase records in 2024–2026, but it has not supplied the exact order date and deletion history for every affected customer.
- What exactly starts the 180-day clock? Is the deletion rule measured from every order, from a customer’s latest order or from another event?
- Which copies were covered? Did the rule include Shopify records, third-party apps, support tickets, exports and backups?
- Who verified completed deletion? Keystone’s FAQ says Shopify performs the final step, but the company has not published a technical or independent audit of its retention controls.
- What was the attacker’s path? The company has not specified the compromised system, credential or integration, or released a forensic report.
What Keystone buyers should do now
Keystone says it is emailing affected users. Customers should independently navigate to the company’s official website instead of clicking links in unexpected messages. Treat unsolicited calls, letters, QR codes and offers of free replacement hardware with caution. Never provide a recovery phrase or private key to someone claiming to be support.
A checkout-data breach alone is not a reason to type a recovery phrase into a new device or move funds to a link supplied in a message. If a recovery phrase has already been disclosed to an untrusted party, the wallet should be treated as compromised and recovery steps taken using independently verified tools.
For buyers, the immediate danger is not only that an attacker may know where a device was delivered. It is that the attacker could use that fact to appear trustworthy.
What the documents establish — and what they do not
Confirmed: Keystone acknowledged the customer-data breach. Its own published pages describe the 180-day policy in different ways. The incident exposed order-related personal information, according to the company.
Not confirmed: Whether data from any specific order older than 180 days was extracted, whether Keystone actually failed to execute its stated deletion policy, how the attacker accessed the information and how many people were affected.
Keystone has promised more findings. Until the age of the exposed records and the workings of its deletion process are explained, the central question remains unresolved: did the 180-day privacy promise protect the customers it was meant to protect?
Reporting method: BlockBriefing reviewed Keystone’s public privacy pages and FAQ, its reported breach statement, The Block’s customer-account reporting, and official disclosures from Trezor and SafePal. This is a document-led analysis, not an independent forensic examination. The report will be updated if Keystone provides additional verifiable information.
