Self-Custody
Keystone Breach: What Leaked, What Didn't
Keystone's breach exposed 25,964 buyers' addresses and its device authenticity key. Here's what leaked, what stayed closed, and what to check now.
If you own a Keystone hardware wallet, or were about to buy one, give the Keystone wallet breach ten careful minutes. On October 20, 2026, an attacker got into Keystone's official website through a flaw in a third-party data monitoring tool. By October 26, the company's own security report said what that access reached: personal records for 25,964 customers, and the key Keystone uses to prove that its devices are genuine. It also said what the attacker did not reach: recovery phrases, private keys, wallet passwords, and payment card or bank details.
Those two lists lead to different actions. A leaked mailing list is a phishing and physical-safety problem. A leaked authenticity key is a supply-chain problem. Neither one hands anybody your seed. The checklist at the end sorts out which of them applies to you.
What Keystone Says Happened, Day by Day
The story moved fast, and the early coverage is already out of date, so the order matters.
On October 20, Keystone detected unauthorized access to its website, blocked it, and disabled sensitive site functions. On October 23, after checking API activity with Shopify, which runs its store, it confirmed that a third party had obtained customer shipping information. On Saturday, October 24, it said so publicly: names, contact details, shipping addresses, and order details such as the items bought and what they cost. As Cointelegraph reported, the company gave no customer count at that point.
On October 26, Keystone published the fuller report. According to crypto.news's summary of that announcement, the investigation found 51,083 purchase records tied to the store. Personal data had already been erased from 25,119 of them. The remaining 25,964 records, from purchases made between 2024 and 2026, still held names, contact information, addresses, and order details. Another 12,873 abandoned checkouts also held personal information from people who never finished paying.
The Keystone Data Breach and the 180-Day Promise
Keystone had marketed a privacy promise: shipping data deleted 180 days after an order. Over the weekend, several customers said on X that they got breach notices for orders more than two years old, and The Block collected those claims. One described a call from someone posing as police who knew the details of a 2024 Keystone order.
The October 26 report answered the question. Keystone said an automated deletion tool had failed to remove some records within the 180-day window, and that it did not catch the failed deletions in time. It has cut retention to 90 days and filed deletion requests with Shopify on October 24. Shopify holds those requests for 10 days, so the overdue records are expected to be gone by November 3.
So the policy existed on paper, a background job failed to carry it out for some orders, and Keystone did not notice in time. It has not said how many of the exposed records were past the 180-day mark.
The Stolen Authenticity Key: The Bigger Change
The second item is newer and matters more for anyone holding or buying a Keystone device. Keystone says the attacker also took its WebAuth key. That key is written into each device during manufacturing, and it is what the company's authenticity check uses to confirm that a device came from Keystone. It plays no part in generating recovery phrases, deriving private keys, or signing transactions.
The problem is what it could let someone fake. With that key, an attacker could build a counterfeit device that passes Keystone's own authenticity check. The key cannot be erased or rewritten once installed, so Keystone is destroying the 18,835 devices in its inventory that carry it, has moved production to a new key, has suspended shipments of unfulfilled website orders, and is selling on preorder until new units ship.
Keystone's guidance splits owners by date. A device delivered before October 20 that passes authentication remains safe to use, in the company's words. If your device arrived after October 20 and carries the old key, Keystone asks you to contact support for extra verification before you use it. The company also said it will not ask anyone to return a wallet, so a "recall" request is a scam by definition.
What Stayed Behind the Gate
By Keystone's account, the attacker never reached recovery phrases or private keys. Recovery phrases and private keys are created on the device and never stored on the website, because a hardware wallet's whole security model depends on those secrets never touching an internet-connected system. Wallet passwords, payment data, and government ID numbers were not exposed either. Keystone also said that existing owners do not need to move their coins because of this incident. Treat any message asking you to migrate a wallet, verify your assets, or help with an investigation as part of the attack.
Why a Leaked Address List Is Still a Real Risk
It's tempting to read "your keys are safe" as "you're fine." For your coins, mostly, you are. But self-custody was never only about where the seed lives. It is also about who knows you have one, and where you sleep. A dated list tying real names to home addresses, drawn only from people who bought crypto hardware, is built for two follow-ups: phishing that quotes your real order, and, rarely but on record, a physical approach. Cointelegraph cited CertiK's count of 52 verified "wrench attacks" worldwide in the first half of 2026, up from 39 a year earlier.
Where NexusPool Draws a Different Line
NexusPool doesn't sell hardware and isn't part of this story, but the lesson is one it is built around: data a system never collects cannot leak from it. The block pays your address. There is no balance for us to hold, and a payout to a Bitcoin address does not need your name or your home address. NexusPool's Payout Preflight shows the exact coinbase transaction that would pay your address on the current block template, before any block is found, so you check the destination yourself instead of trusting an account page.
The accountability side works the same way. Each hour, NexusPool signs a receipt for the work the pool counted, using BIP340 signatures against a key it publishes, and Glass Ledger is where you check it or write your own code against that key. How the pieces fit together is on NexusPool's technology page, and the NexusPool home page has the connection details.
Your Keystone Breach Checklist
Work through it in order.
- Where you bought. Check whether you ordered from Keystone's own website, including a checkout you started and abandoned, since that store is the system Keystone says was accessed. Keystone is emailing affected customers and has said a lookup page is coming.
- Contact is suspect. If you did order there, assume your name, address, and order details are known outside Keystone. Treat any call, text, email, or letter that cites your order as phishing by default, even when it claims to be the police.
- Your seed goes nowhere. Never type your recovery phrase into a website, app, or form, and never enter it into a device you did not order yourself. No real support process needs it.
- Check the delivery date. If your device arrived before October 20 and passes authentication, Keystone says it is safe to use. If it arrived after October 20, contact Keystone support through its official site before you use it.
- No recalls, no migrations. Ignore any request to return your wallet, move your coins, or "verify" your assets. Keystone says it will not ask for any of these.
- Deletion has a date. Keystone expects the overdue records to be deleted by November 3 and has promised a way to confirm that your data was erased. Check it when it exists.
If you ordered from Keystone's website, be careful with anyone who contacts you; your coins need no action. If your device arrived after October 20, add one step: verify it with Keystone before you trust it with funds. If you never ordered from Keystone's website, nothing here changes what you need to do today.
This post relies on Keystone's own statements and the reporting linked above. It does not independently confirm the counts, the cause, or whether the authenticity key has been used. It makes no claim that NexusPool's source code is public, or that any pool or payout tool can stop a phishing attempt built from leaked shipping data. It isn't investment or financial advice, and holding bitcoin on any hardware wallet carries risks that no checklist removes.
Trust nothing. Verify what a company actually stored about you, and verify the device before you trust the check that says it's genuine.