Keystone said an attacker took buyer data and its device authentication key, so it will destroy 18,835 wallets in stock and has paused website shipments.
Key Facts
Keystone said an attacker who breached its website obtained the key it uses to check whether its hardware wallets are genuine, along with personal data tied to 25,964 buyer records.
The company will destroy 18,835 devices in inventory that carry the old key, has suspended shipping of unshipped orders from its website and is moving sales to preorders.
Keystone said recovery phrases, private keys and bank payment information were not involved, and that users do not need to move their assets solely because of the incident.
Hardware wallet maker Keystone will destroy 18,835 devices in its inventory after an attacker obtained the key it uses to verify that its wallets are genuine, the company said on Monday.
The stolen key could let an attacker build counterfeit devices that pass Keystone's authenticity checks, a risk the company said could lead to asset theft if fake units reached customers.
"If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks," Keystone said in a statement on X. "These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft."
How the Keystone Breach Happened
Keystone said its monitoring systems detected unusual access to its website on Oct. 20. The attacker exploited a vulnerability in a third-party data monitoring tool used by the site to escalate privileges, according to the company.
The breach exposed names, contact details, shipping addresses and order information in 25,964 buyer records from purchases made through its Shopify store between 2024 and 2026.
Keystone said its policy was to erase buyer data after 180 days, but an automated bulk-erasure tool did not operate reliably, and it accepted responsibility for failing to delete the data on time. It said 12,873 unpaid checkout records also contained names, contact details and shipping information.
Keystone said the incident did not involve recovery phrases, private keys, bank payment information or government ID numbers.
What Keystone Wallet Owners Should Do
The authentication key is written into devices during manufacturing and cannot be erased or rewritten, though it is not used to generate recovery phrases, derive private keys or sign transactions, the company said.
Devices delivered before Oct. 20 can still be treated as genuine if they pass authentication, Keystone said. Buyers who received a device with the old key after that date should contact support for extra checks because, even if it passes authentication, "we cannot completely rule out the possibility that it is counterfeit."
All new hardware wallets will use a new key. Keystone warned that it will not ask users to return devices, and said anyone asking users to ship one under the pretext of a "recall" should be treated as a scammer.
Fake recall requests are a form of phishing.
Other wallet security incidents have surfaced this month. Ledger said criminals planted implants in wallets sold through Southeast Asian resellers, and Polkadot said the Fearless Wallet extension had been leaking private keys since February 2025.
This article contains links to third-party websites or other content for information purposes only ("Third-Party Sites"). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author's [company's] own and do not necessarily reflect those of CoinMarketCap.
