Keystone confirms a Shopify store breach exposed hardware wallet buyers' addresses

Keystone, a Hong Kong-based maker of hardware cryptocurrency wallets, said on Oct. 24 that an intruder had accessed its online store run on Shopify and taken names, contact information, delivery addresses, and purchase records, but not payment information, wallet recovery phrases, or private keys. The company spotted unauthorized access on Oct. 20 and confirmed on Oct. 23 that a third party had obtained shipping data. It said it blocked access, fixed the vulnerability, started an investigation, and began emailing affected customers, but gave no victim count, entry point, or attacker details. Keystone also warned buyers that imposters might contact them with refund, device, or fix offers and told them not to enter recovery phrases on devices they had not ordered.