Data breach at a hardware wallet supplier: how to spot phishing and what to do now

After a data breach at a hardware wallet supplier, hardware wallet phishing is the risk to watch for now. With these steps you recognise a fake message and know what to do.

In short

• Keystone reported on 24 October 2026 that an unauthorised party retrieved customer data via its own web shop: name, contact details, shipping address and order details.
• According to Keystone, payment details, recovery phrases, private keys and wallet passwords were not exposed.
• After such a breach, the real risk is hardware wallet phishing: an email, letter or phone call that matches your real order.
• You never enter your recovery phrase and never share it, with anyone, for any reason.
• Firmware you only get through the manufacturer's official route, and a device you only buy from a reliable seller.

What happened at Keystone

Keystone is a manufacturer of hardware wallets. On 24 October 2026 the company reported a data breach via its own web shop. According to Keystone, the company discovered the access on 20 October and confirmed on 23 October, after checking API activity together with Shopify, that a third party had retrieved customer data. Crypto Briefing also wrote about it: Keystone: data breach via website exposed customer data.

It concerns names, contact details, shipping addresses and order details, including purchased items and prices. Keystone says payment details, recovery phrases, private keys and wallet passwords were not exposed. The company says it has blocked the access and patched the vulnerability. An investigation has been started and affected customers are being informed by email. A full report will follow shortly.

About the number of affected customers, the duration of the access and the perpetrator, nothing was confirmed at the time of writing. We therefore do not fill that in.

This piece is not a verdict on Keystone. Web shops of every brand, even the biggest, can face an incident like this. What matters to us is what you, as the owner of a hardware wallet, can best do, whichever brand you have.

Why an address leak is the real risk

Een herstelzin is veilig zolang niemand je ernaar laat typen. Een aanvaller met alleen je naam, adres en bestelgeschiedenis kan dus niet bij je bitcoin. Maar hij kan wel geloofwaardig klinken. Dat is de kern van hardware wallet phishing: de oplichter bewijst met jouw eigen gegevens dat hij “van het bedrijf” is.

Our assessment: an order of a hardware wallet can help a scammer sound credible. That is why every message that refers to your order is extra suspicious.

Keystone waarschuwt zelf dat oplichters zich via telefoon, sms, e-mail of post als Keystone voordoen. Ze bieden terugbetalingen, vervangende apparaten of “oplossingen” voor je bestelling of adres aan. Volgens Keystone komt niets daarvan van het bedrijf. Daaruit zijn vier gangbare scenario’s af te leiden.

1. The phishing email

Een mail met je echte naam en een echt bestelde artikel. “Door een beveiligingsincident moet je je apparaat verifiëren.” Een knop leidt naar een nagemaakte site die om je herstelzin vraagt, of om een “synchronisatie” van je wallet.

2. The fake letter or fake parcel

Ook post is mogelijk, omdat een adres bekend is. Denk aan een brief met een QR-code, of een pakketje met een “vervangend apparaat” in de originele verpakking. Dat apparaat is dan gemanipuleerd of vraagt bij het opstarten om een herstelzin die al is ingevuld of die je moet “herstellen”.

3. The fake replacement device

An offer to replace your device for free because of the breach. A device you did not order yourself, you do not use. Never put bitcoin on it.

4. The fake support contact

Een telefoontje, sms of chat van “de beveiligingsafdeling”. Ze kennen je bestelling, dus het voelt echt. Ze willen dat je een link opent, software installeert of “even” je woorden voorleest.

Recognising hardware wallet phishing

No single sign is proof on its own. Together they give a clear picture.

• A request for your recovery phrase. Real manufacturers, shops and support never ask for it. This is the most important sign, and the only one you do not need to debate.
• Haast. “Binnen 24 uur of je wallet wordt geblokkeerd.” Een hardware wallet kan niet op afstand geblokkeerd worden.
• An unexpected offer. Refund, free replacement, bonus. You did not ask for it.
• A different sender address or domain. Look at the letters after the @ and in the link. One letter of difference is enough for a fake site.
• A link or QR code instead of the official route. Type the address in yourself, or use a bookmark you saved earlier.
• A request to install software or share your screen. Support does not need that to answer a question for you.
• A parcel or letter you did not expect. Do not open, use or scan anything.

What to do now

Never enter your recovery phrase and never share it

Your recovery phrase only goes into your hardware wallet itself, during a recovery that you start yourself, on a device you bought yourself from a reliable seller. Not on a website, not in an app following an email, not to an employee, not in a photo. If you want to know how to store it safely, you will find the basics in our guide to mistakes when storing yourself.

Only get firmware through the official route

Updates come through the manufacturer's official app or website, which you open yourself. Not through a link in an email, message or social media. With every update, check that the device itself confirms the action. If a screen appears that asks for your recovery phrase during an update, stop and disconnect the device.

Only buy a device from a reliable seller

Koop bij de fabrikant of een erkende verkoper. Een apparaat van een marktplaats of een onbekende verkoper kan al geopend zijn. Een apparaat met een al ingevulde herstelzin of een kaartje met “instructies” is een alarmsignaal. Onze hardware wallets vind je in the Hardware Wallets category.

Treat every unexpected message as suspicious

Use nothing from the message. Go to the manufacturer's official website yourself and check whether there is really a notice. Call back a number you look up yourself, not the number in the message.

Get your security in order

Gebruik een uniek wachtwoord en tweestapsverificatie voor het e-mailadres dat je bij bestellingen gebruikt. Wie je mail overneemt, kan “wachtwoord vergeten” op andere accounts doen. Meer praktische punten staan in Don't get hacked.

Know which data you leave behind yourself

Every web shop stores something. Which data we store and what happened with an earlier breach is described on our privacy page. Read it as it stands: we promise nothing extra here.

Affected by a breach? How to carry on

Your bitcoin itself is not automatically in danger, even if your address is known. Do not change anything rashly with your wallet. Do not move your bitcoin because an email says so. Only if you ever entered or shared your recovery phrase, treat it as leaked and move your bitcoin to a new wallet with a new recovery phrase, created on a device you bought yourself. Keep an eye on news from the manufacturer through the official channels. For news about another brand, see our Ledger news.

Frequently asked questions

Can someone get to my bitcoin with my name and address?

No. Not without your recovery phrase or private keys. Data such as name and address give no access to your wallet. They do make scammers more credible, which is why your recovery phrase remains the one thing you never have to share. One rule of thumb helps against hardware wallet phishing: your recovery phrase never belongs on a screen you did not open yourself.

Should I move my bitcoin after a data breach at my supplier?

Not if your recovery phrase has not leaked or was not entered by you yourself. According to Keystone, recovery phrases were not exposed. Moving is necessary if you ever gave your recovery phrase on an unsafe place, into a website or to someone else.

How do I know if an email from the manufacturer is real?

Do not trust the message itself. Open the official website via your own bookmark and check whether the same notice is there. Real messages never ask for your recovery phrase and do not put you under time pressure.

May support ask for my recovery phrase?

Never. No reliable manufacturer or shop asks for it, for any problem.

What if I receive a replacement device by post?

Do not use it and do not put bitcoin on it. Contact the manufacturer through the official website and report the shipment.

Is a hardware wallet still safe after such a breach?

The breach concerns the web shop, not how the device works. Keystone names only its own web shop as the place of the incident. A hardware wallet keeps your keys offline, even when data from the shop gets out. What matters is what you do afterwards with messages that come in.

Sources

• Keystone, official post on X, 24 October 2026: https://x.com/KeystoneWallet/status/2114054080754770137
• Crypto Briefing (secundair), “Keystone Hardware Wallet says website breach exposed customer data”: https://cryptobriefing.com/keystone-data-breach-exposed-2026/