Keystone's data-deletion promise falls apart

Keystone, a maker of hardware crypto wallets, told customers it deletes their order data within 180 days in most cases. Customers now say a breach exposed data from orders well past that window, and they're asking Keystone to explain the gap.

What customers found

Users on X began comparing notes after the breach surfaced, matching exposed records against order dates that should have aged out under Keystone's own policy. The complaints center on one question: if the data was supposed to be gone, why was it still sitting somewhere to be stolen?

• Keystone states it deletes customer order information 180 days after an order in most cases, per The Block.
• Multiple affected customers cited on X say their exposed data traces to orders placed well beyond that six-month window.
• Keystone sells devices that store private keys offline specifically to minimize what a breach can touch, making any leak of shipping or identity data a direct hit on its core sales pitch.

A retention policy that didn't hold

The default read here is a garden-variety data breach, the kind every hardware vendor eventually discloses. That framing misses the actual fault line: Keystone didn't just lose data, it lost data it told customers would no longer exist.

A breach of current customer records is a security failure. A breach of records that should have been deleted under a stated policy is a trust failure, and it's a different kind of problem for a company whose entire business rests on the promise that it minimizes what can be taken from you.

Hardware wallet buyers pay a premium specifically to reduce their exposure surface. Shipping addresses and order history tied to crypto purchases are exactly the kind of data that turns into real-world risk when it leaks, enabling targeted phishing or even physical targeting of known holders.

If Keystone's retention policy wasn't actually enforced in practice, the company's core security pitch has a hole in it that has nothing to do with the hardware itself. The device can be flawless and the company can still expose you, because the weak point was a database, not a chip.

What would confirm the gap

The open question is whether this is a documented exception to the 180-day policy, a technical failure to purge data on schedule, or a policy that existed on paper but was never operationalized. Each has a different fix and a different level of culpability.

• Watch whether Keystone publishes the actual date range of exposed orders and reconciles it against its stated 180-day deletion window.
• Watch for a public explanation of why older order data was retained, whether as a backup, a legal hold, or an operational failure.
• Watch customer reports for a pattern: if exposed records cluster just past 180 days versus scattered across years, it points to a process bug versus a policy that was never real.