POPA ReconKeystone breach via third-party tool exposed 25,964 orders
12,873 incomplete checkouts also exposed of 51,083 Shopify records.
18,835 unsold devices destroyed after auth key leak, new units use new key.
Source reports
- 🚨 LATEST: Keystone discloses a website breach that exposed hardware wallet buyers’ names and shipping addresses, raising fears of targeted scams and wrench attacks. https://ct.com/news/keystone-says-website-breach-exposed-hardware-wallet-buyers-addresses — @Cointelegraph (X), Oct 26, 2026, 07:30 UTC
- day 8 of one onchain find a day until 10k reports say keystone's breach exposed customer addresses and order details. the company says recovery phrases and private keys were not exposed — @PopaRecon (X), Oct 26, 2026, 09:13 UTC
- ICYMI: 🚨 Hardware wallet maker Keystone says a third party accessed its website and obtained customer names, contact details, shipping addresses, and order info. — @CoinMarketCap (X), Oct 26, 2026, 12:23 UTC
- Keystone Breach Exposed 25,964 Purchase Records and Compromised Device Verification Key Keystone said its latest investigation found that attackers obtained a WebAuth device-authentication key through the website breach, potentially allowing counterfeit hardware wallets to pass… — @WuBlockchain (X), Oct 26, 2026, 14:37 UTC
- Update on Keystone confirms website breach exposing customer data and device authentication key, halts shipping - 𝕏/@keystonewallet 🔗 Discord · Leviathan · Source 🗺️ Keystone · Breach 🕵️ @w00tcake 💬👤 @Danicjade: zero due diligence. I thought they said there was no wallet breach… — Закрепи.sender, Oct 26, 2026, 14:50 UTC
- Update on Keystone confirms website breach exposing customer data and device authentication key, halts shipping - 𝕏/@keystonewallet 🔗 Discord · Leviathan · Source 🗺️ Keystone · Breach 🕵️ @w00tcake 💬👤 @Danicjade: zero due diligence. I thought they said there was no wallet breach… — Rickler Feed, Oct 26, 2026, 14:50 UTC
Excerpts are quoted from the linked sources, which own their text.
POPA Recon's research of this event
POPA Recon's research of this event
Follow @PopaRecon on X for new finds, and Web3AlphaFeed on Telegram.