Keystone Plans to Destroy 18, 835 Hardware Wallets After Authentication-Key Breach
Keystone says attackers accessed its website on October 20, stole a device-authentication key and exposed customer records. The company says recovery phrases and private keys were not compromised, but the stolen key could allow counterfeit devices to pass its authenticity checks.
- 18, 835 in-stock wallets containing the key are slated for destruction.
- Records tied to 25, 964 purchases and 12, 873 incomplete checkouts were exposed; the number of unique people affected is unknown.
- Keystone says customers do not need to return wallets or move funds.
- Shipments of unfulfilled orders are paused, while sales continue through preorders.
What the Stolen Key Can and Cannot Do
In a security announcement on October 26, Keystone said attackers exploited a vulnerability in a third-party data-monitoring tool connected to its official website. The company said it blocked unauthorized access and disabled sensitive website functions on October 20. It then fixed the vulnerability and began a forensic investigation.
The stolen credential, called the WebAuth key, is installed in wallets during manufacturing and used to check device authenticity through Keystone’s website. Keystone says the key cannot be erased or rewritten once installed, so it plans to destroy the 18, 835 in-stock devices that contain it. The company has stopped using the key in manufacturing and switched to a replacement.
The WebAuth key is separate from a wallet’s private keys and recovery phrase. Keystone says it does not generate recovery phrases, derive private keys or sign transactions. The company also says recovery phrases, private keys, wallet credentials, banking information and government identification numbers were not compromised.
The stated risk concerns device verification: a counterfeit wallet made with the stolen key could potentially pass Keystone’s authenticity check. Keystone has not reported that counterfeit devices were produced or distributed. It also has not described the technical details of the check or provided evidence that the key was used to authenticate counterfeits. This is a supply-chain concern, not evidence that attackers can access customers’ funds.
What Customer Information Was Exposed?
Keystone identified 51, 083 purchase records associated with its official Shopify store. The company said personal information in 25, 119 records had been erased before the attack. The remaining 25, 964 records contained names, contact information, shipping addresses and order details for purchases made between 2024 and 2026.
Investigators also identified 12, 873 incomplete checkout records containing information submitted by people who did not complete payment. Keystone has not clarified whether these records overlap with the purchase records. The figures count records, not necessarily individual people, so the total number of unique people affected is unknown.
Keystone attributed some of the exposure to a failure in its own data-deletion process. An automated tool did not remove certain records within the company’s required 180-day retention period. Keystone said it did not detect the failed deletion requests in time. The company has since shortened its retention period to 90 days.
On October 24, Keystone submitted deletion requests to Shopify for overdue purchase records. Shopify’s process includes a 10-day waiting period, and Keystone said it expected the deletions to be finalized by November 3. The company also submitted separate requests to delete incomplete checkout information retained for longer than 30 days. Keystone has not confirmed whether all overdue records were ultimately deleted.
Keystone’s announcement says the records were exposed, but does not establish whether attackers downloaded or used them. Names, contact details and shipping addresses can still help scammers craft convincing phishing or impersonation attempts. Customers should be wary of unsolicited messages offering support or arranging a device return.
What Keystone Customers Should Do
Keystone says devices delivered before October 20 remain safe to use if they pass authentication. Customers who received a device after that date and believe it may contain the old key should contact Keystone support for additional verification before using it. The company has not said how many devices delivered after October 20 contain the old key.
Keystone says customers do not need to return their wallets or move their cryptocurrency. It warns that requests to send devices back under the guise of an official recall may be scams. Customers should use contact details on Keystone’s official website, not links or phone numbers in unsolicited messages.
The company says affected customers will receive individual email notifications. It also plans to launch a lookup page where customers can check whether their information was exposed, along with a separate service to confirm whether personal data has been erased. Keystone has not announced launch dates for either service.
Shipments of unfulfilled website orders are paused. Keystone says sales will continue through preorders while it prepares devices using the replacement key. The company has not provided a timeline for resuming normal shipments.
Key Questions and Answers
-
Were Keystone recovery phrases or private keys stolen?
Keystone says they were not. The stolen WebAuth key is used for device-authenticity checks, not to control funds or sign transactions.
-
Do customers need to return their wallets or move their crypto?
No, according to Keystone. The company says customers do not need to return devices or move funds, and warns that supposed recall requests may be scams.
-
Which customers should contact Keystone support?
Customers who received a device after October 20 and believe it may contain the old key should contact support for additional verification before using it. Keystone says devices delivered before that date remain safe to use if they pass authentication.
-
Were counterfeit devices made with the stolen key?
Keystone has not reported that any were produced or sold. The company says the key could allow a counterfeit device to pass its authenticity check, but has not disclosed evidence that this happened.
-
How many people were affected by the data exposure?
Keystone disclosed record counts, not the number of unique people affected. It has not clarified whether the 12, 873 incomplete checkout records overlap with the 25, 964 affected purchase records.
The Broader Security Lesson
A hardware wallet’s security depends on more than the device that stores signing keys. Website tools, manufacturing credentials, data-retention systems and service providers can all create risks around a wallet, even when its private keys remain offline. Personal information brings its own risks: it can give scammers material for targeted messages without giving them direct access to funds.
Keystone’s response includes replacing the authentication key and destroying affected inventory. The next tests are whether the company can verify that overdue records were deleted, clarify the full scope of the exposure and deliver the customer lookup and data-erasure services it has promised.
