OneKey Caps Data at 30 Days After Keystone Breach Exposes 26,000 Records

- OneKey pledges 30-day deletion after rival breach exposes 26,000 customer records - Keystone’s failure to erase data triggers sector-wide scrutiny and tighter retention policies On 2026-10-27, CoinDesk reported that OneKey will permanently erase all customer order data within 30 days. The outlet noted that the company introduced this policy following a major supply chain breach at hardware wallet rival Keystone, which allegedly failed to delete user records as promised. The incident resulted in a leak that exposed nearly 26,000 customer records and device authentication keys, and it prompted OneKey to overhaul its data handling and audit policies amid growing sector-wide vulnerabilities. On 2026-10-26, Cryptonomist reported that OneKey founder Yishi Wang directly linked the new retention limit to industry risks highlighted by Keystone’s breach. In addition, ForkLog reported that attackers accessed 25,964 buyer records and 12,873 incomplete checkout entries, including names, addresses, contact information, and order histories, after Keystone’s automated 180-day deletion policy for Shopify data silently malfunctioned. According to ForkLog, this malfunction left records from 2024 exposed and compromised, and attackers also obtained a WebAuth hardware authentication key that investigators traced to a vulnerability in a third-party monitoring tool. As a result, Keystone conducted a recall of 18,835 affected devices and reduced its retention window to 90 days. Other hardware wallet firms, such as Trezor and SafePal, have faced similar breaches, and these incidents mainly stemmed from fulfillment partners and e-commerce platforms that failed to promptly delete or anonymize buyer information. The Register reported in August 2026 that Trezor’s logistics partner ShipMonk exposed 81,000 customer records, while SafePal shortened its retention period after an incident affecting nearly 40,000 users. However, despite updated policies, challenges persist because deletion guarantees rely on third-party compliance and reliable automated systems. OneKey’s move to limit data retention to 30 days and launch comprehensive supply chain audits reflects intensified industry efforts to address these risks. Companies now seek to enforce stronger partner oversight, shorten exposure windows, and protect personally identifiable information, while the Keystone breach underscores that supply chain vulnerabilities—not just vendor policies—continue to drive urgent calls for stricter data controls across the hardware wallet sector. As a result, incident reports and official statements from OneKey and Keystone indicate ongoing shifts toward stricter retention limits and enhanced oversight as hardware wallet companies respond to persistent risks from breaches and supply chain attacks.