Keystone user data leak: how to protect yourself from phishing and targeted attacks

Keystone customer shipping addresses leaked online

Keystone suffered a security breach on their website – attackers got access to customer delivery addresses. Security experts warned the community that these order details put crypto holders in danger. We're talking targeted phishing and actual physical attacks.

Then the second scandal hit. Keystone publicly claims they wipe customer personal data 180 days after an order. People on X quickly proved otherwise: the leak included details from orders placed way before that deadline. Brutal.

Nasty situation. People buy hardware storage specifically to isolate themselves from online risks, only to get doxxed right at their front door.

The 180-day promise versus reality

The Keystone mess highlights an old industry problem: the massive gap between privacy policies on paper and actual log retention. When a company claims on their site that data gets cleared in 180 days, buyers expect digital oblivion. In reality, old records sit around for years on web store servers, CRM databases, and third-party logistics systems.

X is full of angry comments right now. People are asking one basic question: why did months-old purchase data end up in hackers' hands? No clear answer yet. The database is out there.

Attackers got a ready-made hit list: full names, physical addresses, and proof that these people own crypto at home. That sets up two types of attacks.

• Targeted phishing. Emails pretending to be Keystone with fake firmware updates or bogus device lock warnings.
• Physical intimidation. The threat of someone showing up at your door with a five-dollar wrench.

What to do if your data leaked

Too late to panic – time to adjust your personal security setup. A leaked shipping address isn't a private key compromise (your seed phrase stays safe inside the secure element). But the psychological pressure on hardware owners starts right now. For real.

We recommend taking a few clear steps:

• Delete any emails claiming to be from Keystone immediately. A wallet manufacturer will never ask you to enter your seed phrase on a website, verify balances, or re-authenticate your device.
• If someone mails you a replacement device claiming your old one was compromised, throw it away or send it for an independent audit. Never plug in unsolicited hardware from your mailbox.
• Check incoming transactions and wallet links. If attackers tie your physical address to on-chain activity, they'll try tracking your moves. Use our AML checker to monitor incoming and outgoing flows and see how your addresses look to analytics tools.
• Split your assets. Don't keep all your capital on a single wallet tied to a leaked physical address. Spread the main stack: move part of it to cold storage disconnected from your home address, use another part for trading. You can evaluate trading platform security in our crypto exchange reviews section.

Keep your risk profile front and center. Track asset allocation and portfolio balancing with us – check out our public portfolio section to see how we allocate funds during uncertain times.

A lesson for the whole market

This Keystone issue isn't the first hardware breach in crypto, yet people keep making the same mistake. Ordering a hardware wallet to your home address using a personal credit card creates a direct link between your identity and your crypto. If the store gets hacked, they won't steal your seed phrase online – they'll just come knock on your door for it. Simple as that.

When buying security hardware, use neutral delivery locations: PO boxes, office addresses, or pick-up points with generic contact details where allowed.

Hardware wallets are still the security gold standard – assuming you know how to use them properly and don't fall for corporate promises about data deletion. Read our guide on wallet selection and setup to learn how to properly configure cold storage and protect yourself after leaks like this.