Information about this incident and a simple way to see if you may qualify to be connected with independent attorneys.
In October 2026, Keystone, the maker of the Keystone crypto hardware wallet (operated by Yanssie HK Limited), disclosed that an attacker exploited a vulnerability in a third-party data monitoring tool to gain access to its official online store. According to the company's disclosures and published reports, the access was detected on October 20, 2026 and confirmed on October 23, 2026. Keystone first disclosed the incident on October 24 and published a fuller report on October 26.
According to published reports, the incident involved approximately 25,964 purchase records from orders placed between 2024 and 2026, plus approximately 12,873 incomplete checkout records. The information involved may include:
Keystone has stated that recovery phrases, private keys, payment card details and government ID documents were not exposed. Reports also say that the device authentication key used to verify genuine Keystone devices was stolen, and that Keystone plans to destroy 18,835 devices held in inventory and switch to a new key. Some customers have reported that data from older orders was still stored even though the company's privacy terms described automatic deletion after 180 days. Because names, addresses and wallet purchases may be linked, you may want to be cautious about phishing emails, texts, calls or packages that claim to come from Keystone, and never share your recovery phrase with anyone.
As of the date of this page, we are not aware of any lawsuit filed over this incident.
If you bought a Keystone wallet from its official website or received a notice from Keystone about this incident, you may want to understand your options. With your consent, the form below lets us share your information with independent law firms that may contact you.
DataBreachRelief.com is not a law firm and does not provide legal advice. With your consent, information you submit may be shared with one or more independent law firms. Submitting information does not create an attorney-client relationship, and no outcome is guaranteed.
Possible remedies, if any, depend on the facts of your situation and the applicable law. No outcome or payment is guaranteed.
Read the original public notice or report about this incident (opens in a new tab):
DataBreachRelief.com is not a law firm and does not provide legal advice. We are an independent information and referral service. Information you submit may be shared with one or more independent law firms that may contact you about your potential claim. Submitting information does not create an attorney-client relationship. Listing an incident does not mean a lawsuit has been filed, and no outcome is guaranteed. Attorneys who receive referrals may pay us a fee for advertising or lead services.