Keystone Data Breach: Deletion Promise Under Scrutiny

Keystone customers say a breach exposed data the hardware wallet maker promised to delete. Keystone claims it deletes customer info 180 days after orders, but some X users doubt that.

Keystone, a hardware wallet manufacturer, is facing allegations from its own customers that the Keystone data breach exposed personal information the company had promised to delete. The incident has reignited questions about how long hardware wallet makers retain customer data—and whether their deletion promises can be trusted.

What happened in the Keystone data breach

According to customer reports circulating online, a breach at Keystone exposed data that the company had previously committed to removing. Keystone’s stated policy is that it deletes customer information 180 days after orders in most cases. That 180-day window is now at the center of the controversy.

Some users on X have publicly questioned whether Keystone actually follows through on that deletion schedule. The company has not provided details on what specific data was exposed, how many customers were affected, or when the breach occurred. Those gaps leave customers unable to assess their own exposure.

Why the 180-day deletion promise matters

For hardware wallet users, the appeal of a device like Keystone is that private keys stay offline. But ordering one still requires sharing personal details—name, address, and contact information—with the manufacturer. If that data lingers longer than promised, a breach becomes far more damaging.

The 180-day retention period is shorter than many e-commerce companies use, which is why Keystone has highlighted it. However, the phrase “in most cases” leaves room for exceptions. Customers affected by the breach now have reason to ask what those exceptions are.

Trust risk: Hardware wallet buyers choose these products specifically to minimize counterparty risk. A data breach undermines that trust.
Phishing exposure: Exposed order data can help attackers craft convincing phishing emails or physical mail targeting wallet owners.
Policy ambiguity: Without clarity on what “most cases” means, customers cannot know if their data was scheduled for deletion or not.

What customers are saying

Keystone customers who spoke out allege that the breached data should already have been deleted under the company’s own policy. Their complaint is not just about the breach itself, but about the gap between what Keystone promised and what appears to have happened.

On X, some users have cast doubt on Keystone’s deletion claim, pointing to the lack of verifiable proof. Keystone has not released a detailed timeline or independent audit of its data handling practices. That silence is fueling skepticism.

What to watch next

Several open questions remain. First, will Keystone disclose the scope of the breach—what data types were involved and how many customers were affected? Second, will the company clarify the exceptions to its 180-day deletion policy? Third, will affected customers receive guidance on protecting themselves from phishing or identity theft?

For now, the safest assumption for Keystone owners is that any information shared with the company could be at risk. Users should be wary of unsolicited messages claiming to be from Keystone or related services, and should never enter seed phrases on any website or app. Hardware wallet security depends on keeping that phrase offline—regardless of what happens to order data.

FAQ

What is the Keystone data breach?

Keystone customers allege that a breach exposed personal data the company had promised to delete. Keystone has not confirmed the scope, the number of affected customers, or the timing of the incident.

Why did Keystone promise to delete customer data?

Keystone states that it deletes customer information 180 days after orders in most cases. The policy is meant to limit how long personal details are stored, reducing the impact of any potential breach.

How does the 180-day deletion policy affect Keystone users?

If the policy were followed strictly, data from orders older than 180 days should no longer exist. The breach allegations suggest that may not have happened in all cases, which is why some X users are questioning the company’s claim.

Keystone Data Breach Exposes Data It Promised to Delete