Keystone, the hardware wallet manufacturer, has disclosed that a breach of its website exposed buyers' shipping addresses and other shipping details. The company confirmed the exposure but did not say how many customers were affected or how the intrusion happened.
The data at issue isn't account credentials or seed phrases. It's the paper trail of where devices were sent — names and addresses tied to people who bought hardware wallets.
What leaked, and what didn't
According to Keystone's disclosure, the compromised data covers shipping information: the addresses customers gave when ordering, along with other details attached to delivery. The company framed the incident as a website breach rather than a compromise of the devices themselves.
That distinction matters for how customers should react, but it doesn't make the exposure small. Shipping records link a real-world location to a specific purchase. For anyone holding crypto, that's a combination worth taking seriously.
The warning about targeted attacks
A security researcher flagged that the leaked shipping details could be used to target crypto holders with scams. The same data could also make them easier to locate for physical attacks.
Both risks run through the same channel. Someone with a list of addresses and the knowledge that each one belongs to a hardware wallet buyer has a ready-made target list. The scams can arrive by mail, by phone, or in person. The physical threat is the grimmer end of the same spectrum.
Hardware wallet buyers are a specific kind of target. They've already shown they hold assets and took steps to secure them. A leaked address tells an attacker where the person lives.
Why shipping data is a real risk
Breach disclosures often focus on passwords and payment cards. Shipping data tends to get filed under 'lower severity.' That ranking doesn't hold up here.
An email address can be rotated. A home address can't, at least not quickly. When the leaked record connects a person to a crypto purchase, the exposure outlasts the news cycle.
Keystone hasn't said whether it has notified affected customers directly, whether law enforcement is involved, or what it's doing to prevent a repeat. Those are the questions customers will want answered first.
What customers can do now
The practical advice is unglamorous. Treat unexpected messages about a Keystone order, delivery, or support issue as suspect until verified through a channel you chose yourself. Don't confirm order details to anyone who contacts you first. Keep an eye on mail and deliveries that you didn't arrange.
For anyone worried about physical exposure, the standard precautions apply: be careful about what's shared publicly, and don't assume a shipping confirmation is private.
Keystone's next move is the one to watch. The company has confirmed the breach but hasn't yet published the scope of affected customers or a timeline for notifying them. Until it does, buyers are working with incomplete information about whether their address is on the list.
