Keystone breach exposes data kept past its 180-day deadline

Keystone detected unauthorized access to its official website on Oct. 20 and confirmed a breach three days later after reviewing API activity with Shopify. The incident exposed customer names, contact details, shipping addresses and order details, including items purchased, according to Cointelegraph’s report.

The disclosure collides with Keystone’s stated retention policy. Its Privacy Promise page says, “all shipping information is automatically deleted 180 days after your order is placed.” A privacy policy last updated in May 2021 says Keystone erases “all order information of each customer who has not made an order within the last 180 days,” according to The Block’s report.

That makes the breach a data-retention problem as well as a website-security incident. Customers whose orders were more than 180 days old had been told their shipping data was permanently gone, yet records tied to older purchases were among the information discussed after the breach.

Keystone’s strongest account is narrower. The company said financial information, payment cards, bank details, recovery phrases, private keys and wallet passwords were not exposed. It said, “We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.”

The distinction matters for wallets. The exposed records do not, according to Keystone, provide direct access to funds or signing credentials. They do identify people as hardware-wallet buyers and may connect those buyers to physical addresses. The company itself wrote, “You trusted us with those details, and we’re sorry we didn’t keep them safe.”

The fact sheet does not establish how many customers were affected, how the attacker entered the Shopify-powered store, or whether the attacker has been identified. It also does not establish why information from purchases older than 180 days remained accessible. Keystone confirmed the breach on Oct. 23; no customer-notification deadline beyond its statement that it is emailing affected customers is provided.

Customer reports add dates to the retention contradiction. @BlockchainBarmy on X wrote that “214 days had passed between their last order and the breach.” Another user, @trintaetres_33, wrote, “I bought it over two years ago. I received an email notification.” @PEPE_Whale69 said a caller spoofing a Montreal police number used details matching a Keystone order placed in 2024 and attempted to determine whether Amazon, eBay or Keystone “meant anything” to them.

Those reports are not a customer-count or forensic finding, but they show why the deletion promise is central to the incident. A user who relied on the 180-day language could reasonably have treated an old shipping record as removed, while the breach disclosure indicates that the store’s accessible data set extended beyond that stated window.

Keystone also said, “Again, we’re truly sorry to everyone affected.” Its earlier marketing language had framed the policy as a differentiator: “Other hardware wallets keep your data forever. We delete your shipping info in 180 days max.” The current incident leaves the company’s own deletion claim as an open question.

The security stakes are concrete. CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up from 39 in the same period last year. The increase is 13 attacks, or 33.3%: (52 − 39) ÷ 39 × 100. In that setting, exposed shipping information can matter even when wallet credentials remain outside the disclosed breach.

Keystone’s affected customers are worse off because their names, contact details, addresses and purchase histories may remain usable for targeted social-engineering attempts. The immediate next step is notification and investigation; the company has given no public timetable for completing either. The key unresolved issue is whether Keystone can reconcile data exposed on Oct. 23 with a policy promising permanent deletion after 180 days.