Keystone Promised to Delete Your Data in 180 Days: Customers Say It Never Happened
Customers of Keystone, one of crypto's most trusted hardware wallet brands, are claiming a recent breach exposed personal data the company had explicitly promised to destroy, blowing a hole through one of its core privacy guarantees.
The Promise vs. The Reality
Keystone's own policy states that customer information is deleted 180 days after order fulfillment in most cases. That's not a vague disclaimer buried in fine print. That's a specific, measurable commitment that security-conscious crypto holders relied on when choosing Keystone over competitors.
Now, X users who received breach notifications are pushing back hard, saying the exposed data proves Keystone never followed through. If they're right, this isn't just a breach. It's a breach on top of a broken promise, and that's a different level of liability entirely.
Why This Hits Different for Crypto Users
Hardware wallet customers are not casual users. These are people who specifically chose a physical device because they take security seriously. Many of them are holding significant assets. Their home addresses, names, and contact details sitting in an unsecured database aren't just an embarrassment for Keystone. They are a physical security risk for the people holding those wallets.
Crypto hardware wallet owners have been targeted before. In 2020, the Ledger breach exposed data on more than 270,000 customers, and the fallout included doxxing, phishing campaigns, and even credible physical threats against holders. The Keystone situation is drawing immediate comparisons.
What Keystone Has Said
As of now, Keystone has maintained its 180-day deletion policy applies in most cases, which critics are already flagging as a significant qualifier. What counts as an exception? Who decides? The community is not satisfied with that answer, and pressure is building fast for a full public disclosure of what data was stored, for how long, and exactly how it was accessed.
What You Should Do Right Now
If you are a Keystone customer, assume your order data may still be on their servers regardless of when you purchased. Watch for phishing attempts targeting your email and phone number. Be especially alert to any messages referencing your hardware wallet, your order, or your shipping address, as attackers use that specificity to build trust.
More broadly, this is a reminder that trusting a hardware wallet brand with your data is a separate decision from trusting it with your keys. The device may be secure. The company behind it might not be.
Watch Keystone's official channels closely over the next 48 hours. A full incident report is the minimum the community should accept, and anything less will accelerate the reputational damage already underway.