Keystone and Foundation have acknowledged failures that left wallet buyers' personal information stored beyond their deletion deadlines, after separate security incidents exposed shortcomings in how they handled customer records.
Keystone promised deletion after 180 days; Foundation's policy specified 60 days after shipping.
Their investigation updates describe different failures: an unreliable deletion tool at Keystone and older database copies that escaped Foundation's redaction process.
Both companies say wallet private keys and recovery phrases were not compromised. The findings concern information such as names, contact details and shipping addresses, rather than the credentials used to control customers' cryptocurrency.
Keystone Promoted Deletion, but Buyer Records Remained
Keystone had advertised its deletion policy as a reason to choose its products. In a March post cited by The Block, it wrote: 'We delete your shipping info in 180 days max'.
Its 26 October statement identifies 25,964 buyer records from 2024 to 2026 that still contained personal information.
Another 25,119 buyer records had already had those details permanently erased before the unauthorised access. The company also identified 12,873 unpaid checkout records containing information entered by people who never completed payment.
The figures do not establish how many individual buyers were affected or how many records exceeded the deadline. They distinguish records that still held personal details from those already anonymised.
Foundation's later findings, reported by CryptoTimes, identify approximately 5,600 mailing addresses and 5,200 phone numbers, alongside names and email addresses, in systems reachable by attackers.
The company cannot confirm that every record was accessed and is treating them as potentially exposed.
Failed Deletions and Older Copies Escaped Checks
Keystone detected unusual website access on 20 October. Its investigation found that an attacker exploited a flaw in a third-party monitoring tool and obtained customer information.
The company developed an automated tool because erasing individual records through its Shopify backend was inefficient. Some deletion tasks failed, and it did not detect and address those failures in time. Its statement says, 'we accept responsibility for this failure'.
Foundation's problem involved copies left behind when its former online store's database was reorganised.
Its deletion process removed personal details from newer order tables, while older copies retained them. Orders looked redacted in the administration dashboard, which the company had relied on to judge whether information was gone.
The investigation also found gaps involving abandoned carts, contact forms and other records. Customer details from its newer Shopify store had not yet been manually redacted, while automatic deletion tools were still under development.
Foundation's incident became visible through phishing emails that appeared to come from its domains and urged recipients to disclose recovery phrases.
Accurate personal details made those messages more convincing, but not all recipient information necessarily came from its systems: more than 5,000 targeted email addresses were absent from its customer records.
Requested Deletions Still Need to Be Completed
Keystone has shortened its retention period to 90 days. It submitted requests to Shopify on 24 October to erase overdue buyer information, with completion expected on 3 November after a 10-day waiting period. It also requested deletion of unpaid checkout information retained for more than 30 days.
A separate consequence concerns a stolen key used to check whether Keystone devices are genuine.
It is not a wallet private key, but its exposure could allow counterfeit devices to pass authenticity checks. Keystone plans to destroy 18,835 unsold devices containing the old key and has suspended website-order shipments pending replacement production.
Foundation has taken affected legacy services offline and promised a full report. It plans to permanently delete the offline legacy data copy once its investigation ends. Taking that copy offline limits access, but the personal information remains stored until that deletion is carried out.
