Hardware wallet maker Keystone says an intruder took customer names and shipping addresses, but no keys or recovery phrases

Keystone, a maker of hardware wallets for storing crypto offline, has disclosed a customer data breach. The company said its website was accessed without authorization on October 20 and, after reviewing API activity with Shopify, confirmed on October 23 that a third party had obtained customer shipping information, Crypto Briefing reported.

The exposed data includes customer names, contact details, shipping addresses and order details such as items bought and prices. Keystone said payment card and bank details, recovery phrases, private keys and wallet passwords were not compromised. "We owe you an apology," the company posted on X.

Keystone said it blocked the access, patched the vulnerability and is emailing affected customers. It warned that scammers may pose as its staff offering refunds, replacement devices or help with orders, and told users never to share a recovery phrase or enter one into a device they did not order.

What happens next: Keystone said it will publish a detailed report in the coming days.