Keystone account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Keystone’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
Keystone's shop was breached: buyers' addresses are out, recovery phrases are not
Keystone said on 24 October 2026 that it detected unauthorized access to its official website on 20 October and confirmed on 23 October, after checking API activity with Shopify, that a third party had taken customer shipping information. Exposed: names, contact details, shipping addresses, the products ordered and what they cost. Not exposed, according to the company: recovery phrases, private keys, wallet passwords, payment card or bank details. Two days later the story got worse. Keystone said the attacker had also obtained the factory key it uses to prove a device is genuine, so it is destroying 18,835 unsold wallets and pausing shipments, and Decrypt and Cointelegraph put the affected buyer records at 25,964.
Keystone's disclosure on X, 24 October 2026, and its follow-up of 26 October. Reported by crypto.news, The Block, Decrypt, Cointelegraph and SecurityOnline, 24-27 October 2026.
If your Keystone account was hacked: start recovery at the official page (support.keyst.one/), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Keystone account, step by step
These steps follow Keystone’s official process — expect it to take checking the official notice takes minutes; getting a leaked home address off the web takes weeks. Official links only: account recovery · password reset.
Ignore the inbox and go to the source. Keystone says it is emailing affected customers, which is exactly the message an attacker will copy. Read the company's own announcement by typing keyst.one or opening its official account yourself, and reach support through support.keyst.one rather than a link or a phone number in a message.
Do not type your recovery phrase anywhere, for any reason. Not into a website, not into an app you were sent to, not to an agent on a call. No real support process at Keystone or any other wallet maker needs those words, and a message that asks for them is an attack however much it knows about your order.
Do not ship your device anywhere. Keystone says units made before 20 October remain genuine and that it will not ask for returns, so any recall, exchange or verification request that ends with you mailing the wallet is fraud. Update firmware only from inside the official app that you opened yourself.
If you have already entered your recovery phrase somewhere after a message like this, treat the wallet as lost: set up a new wallet with a fresh recovery phrase and move everything to it straight away. Crypto transfers are not reversed, and a recovery service that contacts you first is the next scam.
Then shrink the part that outlasts the news. Take your home address and phone number off the people-search sites that publish them, think about where parcels with crypto hardware get delivered in future, and check whether the email you used for the order shows up in known breach databases.
What trips people up with Keystone
- Keystone warned in its own disclosure that scammers would pose as the company by email, phone, text and even paper mail, offering refunds, replacement devices or help with an order. Every one of those pitches now has your real name, address and the exact model you bought behind it, which is what makes them convincing. Knowing your order proves nothing about who is writing.
- The stolen device key turns the classic recall scam into something that sounds reasonable. Keystone says devices made and shipped before 20 October are still trustworthy, that it has seen no counterfeits built on the stolen key, and that it will not ask anyone to send a wallet back. So a message asking you to ship your device in for a security check, or to swap it for a free replacement, is the scam.
- The leak reached further back than the company's own retention promise. SecurityOnline points out that Keystone's privacy policy, revised in July 2026, says shipping data is deleted after 180 days, yet customers have reported notices about orders older than that. If you bought a Keystone a year or two ago, do not assume you are outside the affected set.
- A list of named crypto owners with home addresses is a physical risk as well as a phishing one, and commentators raised wrench attacks the same day. Keystone is not the only wallet maker whose buyer list leaked this year: Trezor customers went through it via the ShipMonk breach and SafePal through a plug-in flaw. The address is also likely sitting on people-search sites regardless of any breach.
Was Keystone hacked, and is my crypto at risk?
The wallets were not breached; the company's online shop was. Keystone says it spotted unauthorized access to its official website on 20 October 2026 and, after reviewing API activity with its e-commerce provider Shopify, confirmed on 23 October that an outsider had taken customer shipping information. It announced the incident on 24 October, said it had blocked the access and fixed the vulnerability, and began notifying affected buyers. The data covers names, contact details, shipping addresses and order records with products and prices.
Keystone says recovery phrases, private keys, wallet passwords and payment card or bank details were not exposed, so nobody can move funds with what was taken. The follow-up on 26 October is the unusual part. The attacker also got the key Keystone uses to verify that its hardware is genuine, which is written into each device at the factory and cannot be changed afterwards. Keystone says it will destroy 18,835 devices still in stock, has paused shipping, will build new wallets with a new key, and considers units made before 20 October trustworthy.
What is still unclear: Keystone has not published its own count of affected customers or a forensic report. Decrypt and Cointelegraph report 25,964 buyer records from 2024 to 2026, and some customers say they were notified about orders older than the 180 days the company's privacy policy allows it to keep. In practice, assume your name, address and the model you bought are in circulation, and judge every message about your wallet by how it reached you, not by what it knows.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Keystone's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Keystone?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Keystone). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
The attacker spent, moved or stole money
Report the unauthorized transactions to Keystone through the official flow the moment you're back in (or even before — fraud reports don't require account access). U.S. consumer protections for electronic transfers generally limit your liability the faster you report, so speed matters more than completeness. Also call the bank or card issuer behind the funding source — they can dispute, reverse or block further charges — and file at reportfraud.ftc.gov so the pattern is on record.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Keystone (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Keystone itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Keystone account, answered
How did my Keystone account get hacked?
The most common cause isn't a hack of Keystone itself — it's credential stuffing: a password you used on Keystone leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Keystone login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Keystone account back?
Usually yes. Use the official recovery flow (https://support.keyst.one/) — it can verify you even when the attacker changed the email and password. Expect it to take checking the official notice takes minutes; getting a leaked home address off the web takes weeks; respond quickly to follow-ups so the case stays open.
Should I just make a new Keystone account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Keystone can lock it, before you start over.
Will I get money back that was stolen through my Keystone account?
Often, if you move fast. Report the unauthorized activity to Keystone and to the bank or card behind it — U.S. protections for unauthorized electronic transfers generally limit your losses the sooner you report. Peer-to-peer payments you were tricked into sending yourself are much harder to recover than transactions the attacker made — another reason to report the takeover itself, with evidence.
Was my Keystone recovery phrase or private key leaked?
No. Keystone says the breach covered names, contact details, shipping addresses and order records, and that recovery phrases, private keys, wallet passwords and payment details were not exposed. An order record cannot move your funds. Someone asking you to enter your recovery phrase can, which is why the follow-up phishing matters more than the leak itself.
Is my Keystone wallet still safe to use after the stolen key?
Keystone says devices manufactured and shipped before 20 October 2026 remain trustworthy and that it has seen no counterfeit devices using the stolen verification key. The risk sits with devices bought in future from unofficial sellers, which is one more reason to buy only from Keystone directly or its listed resellers.
Why is Keystone destroying 18,835 wallets?
Because the attacker obtained the key Keystone uses to prove its hardware is genuine. That key is embedded during manufacturing and cannot be replaced on devices that already exist, so Keystone decided to destroy the 18,835 units in its inventory, pause shipments and switch new production to a new key.
Keystone emailed me about a refund or a replacement device. Is it real?
Treat it as fake until you confirm it yourself. Keystone specifically warned that scammers would impersonate it with offers of refunds, replacements or help with an order, and it says it will not ask anyone to return a device. Contact support through support.keyst.one, which you type in yourself, and never send the wallet anywhere.
How many Keystone customers were affected?
Keystone has not given its own figure. Decrypt and Cointelegraph report 25,964 buyer records from orders placed between 2024 and 2026. Customers have also reported notices for orders older than 180 days, the period after which the company's privacy policy says shipping data is deleted, so older buyers should assume they may be included.
How do I stop my Keystone account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.