Keystone customers say a breach exposed personal data the hardware wallet maker claimed to delete. The incident matters because it tests whether crypto hardware companies keep their privacy promises, a trust issue for anyone who shares personal information to buy a wallet.
What actually happened
According to The Block, Keystone customers allege a breach exposed personal information the company said it had deleted. Keystone has stated it removes customer data 180 days after an order, in most cases. Users on X have publicly challenged that claim, pointing to the reported breach as evidence information survived past the stated deletion window. The available material does not specify how many customers were affected, when the breach occurred, or what categories of data were exposed. Keystone has not issued a public statement addressing the claims directly in the material reviewed.
How we got here
Hardware wallet makers routinely collect names, shipping addresses, and order details to fulfill purchases. Companies like Keystone build customer trust partly on promises to delete that information once it is no longer needed. The 180-day deletion window Keystone cites was meant to limit how long sensitive data sits exposed. This breach claim, as reported by The Block, tests that promise directly. If deleted data resurfaces in a breach, it suggests the policy was not followed or data persisted in backups beyond the stated period.
Why this matters for you
For current Keystone customers, this raises the question of whether their personal data, including order details, remains at risk even after the company's stated deletion window. Users who bought devices from Keystone more than 180 days ago may want to verify what information was actually removed. For other hardware wallet makers, the episode is a reminder that stated retention policies invite scrutiny. Builders designing wallet or order systems should expect customers and researchers to test deletion claims against evidence, not just marketing language.
The bigger question
If a company promises to delete customer data after a set period, who actually verifies that the deletion happened? Should crypto hardware firms face independent audits of their data deletion policies, similar to reserve attestations, or will customers only learn the truth after a breach exposes the gap?
What to watch
No official response or investigation timeline has been published in the material reviewed. Watch for Keystone's direct reply to customer claims, and for independent security researchers to confirm the scope of the breach. Bonuz will track updates on hardware wallet data practices as this story develops.
