Keystone Leaked Customer Addresses. What About the Keys?

A hardware wallet can keep a private key offline while the shop that sold it keeps a record of where its owner lives. Keystone’s latest breach is a reminder that those are separate security boundaries.

In its October 24 disclosure, Keystone said a third party obtained customer names, contact details, shipping addresses and order information, including products and prices. It said recovery phrases, private keys, wallet passwords and payment-card or bank details were not exposed. These are the company’s findings; Panther has not independently audited its systems.

What Keystone actually disclosed

Keystone says it detected unauthorized website access on October 20 and confirmed the data extraction on October 23 after reviewing Shopify API activity. It says it blocked access, fixed the vulnerability, opened an investigation and began notifying affected customers.

That does not establish a flaw in the signing device or prove that Shopify itself was breached. The disclosure concerns the online store and customer records. The number of affected people and a full technical account were not provided in the statement Panther inspected on October 26.

Independent reporting from ForkLog corroborates the disclosure and documents customer questions about older orders. A public apology answers whether an incident occurred. It does not yet answer the complete scope.

Which 180-day clock was running?

Panther checked two live Keystone pages on October 26. Its Privacy Promises page says shipping information is automatically deleted 180 days after an order is placed. It also offers deletion on request after delivery.

The formal privacy policy, marked last updated July 7, 2026, uses a different formulation: order information is erased for customers who have not placed an order within the last 180 days. A repeat purchase can therefore matter under that wording. Support-ticket retention is described separately.

This distinction prevents a shortcut. An old order date alone does not prove that a customer made no later purchase, identify which database supplied a record, or demonstrate a policy violation. ForkLog reports that buyers with older orders received notifications, but Panther has not authenticated their purchase histories or reviewed the breached dataset.

Keystone should reconcile the two descriptions and explain which records remained, why they remained, and how deletion was verified. A promised retention period is useful only when customers can understand when it starts and what it covers.

The next attack may look like customer service

Keystone explicitly warns about impersonators offering refunds, replacement devices or fixes by phone, text, email and physical mail. Knowing the model someone bought and its delivery address can make that approach sound credible. That is a risk analysis, not proof that every unexpected message came from this breach.

Do not provide a recovery phrase to someone claiming to repair an order. Do not enter it into an unsolicited replacement device. Reach support through an independently verified channel rather than an incoming link or phone number. Preserve suspicious messages and the breach notice if you need to establish what happened.

A customer-data leak does not, by itself, establish that an existing wallet seed must be replaced. Conversely, a claim that seeds were untouched does not make exposed contact information harmless. Panther’s recovery-phrase guide explains the separate consequences when a wallet secret actually is disclosed.

Panther takeaway

Cold storage protects a signing secret. It cannot erase a shipping label from a merchant’s database.

The immediate job is to resist targeted impersonation. The unresolved job belongs to Keystone: publish the affected scope, reconcile its retention wording and provide evidence that its deletion process works. Until then, neither “the wallet was hacked” nor “nothing important leaked” describes the evidence accurately.

PANTHER JOURNAL #062. Verification: original Keystone disclosure, live privacy pages and independent ForkLog reporting, checked October 26, 2026. Conceptual cover illustration, not documentary evidence.