Keystone, which makes the Keystone 3 Pro hardware cryptocurrency wallet, said in a post on X at 01:59 on 25 October 2026 Perth time (17:59 UTC on 24 October) that it had detected unauthorized access to its official website on 20 October and that, "after verifying API activity with Shopify", it confirmed on 23 October that a third party had obtained customer shipping information.

In that post Keystone said names, contact details, shipping addresses and order details (items and prices) were exposed, and that payment card or bank details, recovery phrases, private keys and wallet passwords were not.

It also said it had blocked access, fixed the vulnerability, opened an investigation and was emailing affected customers, and it warned that scammers may pose as Keystone offering refunds, replacement devices or order "fixes" (source: Keystone on X).

At 22:02 on 26 October 2026 Perth time (14:02 UTC) Keystone published an X Article titled "Statement Regarding the Security Incident on Our Official Website and Customer Guidance"; CyberStack could not read its body, so nothing here is credited to it.

According to The Hacker News, Keystone's statement says an attacker exploited a vulnerability in a third-party data monitoring tool used by its website to escalate privileges and obtained customer data and the key its hardware wallets use to prove they are genuine.

Keystone's own 25 October (Perth) post names Shopify API activity instead, and both wordings are given here as each source states them.

According to The Hacker News, Keystone says someone with the key could build counterfeit devices that pass the online check owners use, the incident did not involve owners' recovery phrases or wallet private keys, and the company has not reported any counterfeit devices or thefts; the key is written into each device during manufacturing and cannot be changed (source: The Hacker News; CoinDesk).

In a post on X at 01:17 on 27 October 2026 Perth time (17:17 UTC on 26 October), Keystone said devices received before 20 October remain unaffected and can be used normally, that anyone who received a device after 20 October should contact support@keyst.one for additional authenticity verification, and that it has suspended shipments and will destroy all 18,835 devices in its inventory that use the old authentication key, with new devices using a new key (source: Keystone on X).

Keystone says the incident affected 25,964 buyer records from purchases on its website between 2024 and 2026, and that it has included 12,873 unpaid checkout records as a precaution; government ID numbers were not involved, and purchases through Amazon and other sales channels were not affected (source: The Hacker News).

Keystone says some of these records should already have been deleted under its 180-day retention promise but an automated deletion tool failed without the company noticing; it said "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure" and is cutting retention to 90 days (source: CoinDesk).

The Hacker News says the company has not said when the attacker first got in.

Correction (27 Oct 2026): the card date has moved from 27 to 25 October 2026, the Perth date of Keystone's first statement on X (17:59 UTC, 24 October). Wire: The Hacker News (27 Oct); CoinDesk (27 Oct).