2024

Read

Kingdom

United

Hardware wallet manufacturer Keystone has confirmed that hackers stole a device authentication key and exposed personal information belonging to 25,964 customers, forcing the company to destroy 18,835 devices and suspend shipments.
<div id="cn-block-summary-block_13023a684d9b97ac084b89e8ed32b857" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">Summary
 </div>
 <div class="cn-block-summary__content">
 <ul>
 <li>Keystone confirmed that hackers accessed personal information linked to 25,964 customer records and stole a device authentication key.</li>
 <li>The company will destroy 18,835 hardware wallets from existing inventory because the stolen key could allow counterfeit devices to pass authentication checks.</li>
 <li>Keystone has suspended shipments and switched to preorders until new devices using a replacement authentication key are ready.</li>
 <li>The company said recovery phrases and private keys were not compromised, while customers receiving devices after October 20 may need additional verification.</li>
 </ul>
 </div>
</div>
According to the company’s October 26 security announcement, attackers gained unauthorized access to its official website on October 20 by exploiting a vulnerability in a third party data monitoring tool, which allowed them to obtain customer records and the key used to verify whether Keystone devices are genuine.
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet">
 <a href="https://t.co/IbtXqeqKAX" rel="noopener noreferrer nofollow">https://t.co/IbtXqeqKAX</a>— Keystone Hardware Wallet (@KeystoneWallet) <a href="https://x.com/KeystoneWallet/status/2114719318722404578?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 26, 2026</a>
 </blockquote>
 </div>
</figure>
The company said recovery phrases, private keys, wallet credentials, banking information and government identification numbers were not compromised. However, the stolen authentication key could allow attackers to manufacture counterfeit devices that pass Keystone’s official authenticity checks.
Keystone has stopped using the compromised key in manufacturing and will replace it with a new one. Existing inventory containing the old key will be destroyed, while pending orders will remain on hold until replacement devices are ready.
<h2 class="wp-block-heading" id="strong-keystone-authentication-key-breach-forces-device-destruction-strong">Keystone authentication key breach forces device destruction</h2>
The stolen credential, known as the WebAuth key, is embedded into Keystone hardware wallets during manufacturing and is used when customers check their devices through the company’s authentication website.
Keystone explained that the key cannot be erased or rewritten once it has been installed. Although it has no role in generating recovery phrases, deriving private keys or signing transactions, its exposure creates a problem with the company’s device verification process.
Attackers possessing the key could potentially produce counterfeit wallets capable of passing the authentication checks that customers normally use to confirm whether their devices are legitimate.
You might also like: <a href="https://crypto.news/keystone-wallet-hack-customer-addresses-exposed/" rel="noopener noreferrer nofollow"> Keystone wallet hack exposes buyers’ home addresses, sparking security fears </a>
As a precaution, Keystone will destroy all 18,835 devices currently in inventory that contain the compromised key. Production has switched to a replacement authentication key, and the company has suspended shipments of unfulfilled orders placed through its website.
Sales will continue through a preorder model until manufacturing and shipping can resume.
Keystone said devices delivered before October 20 remain safe to use if they pass authentication. However, customers who received devices after that date containing the old key have been advised to contact support for additional verification before using them.
The company has ruled out asking customers to return their wallets and warned that anyone requesting devices under the pretext of an official recall should be treated as a scammer.
The warning comes after <a href="https://crypto.news/how-did-compromised-hardware-wallets-reach-ledger-customers/" rel="noopener noreferrer nofollow">Ledger investigated compromised devices</a> distributed through a Southeast Asian reseller in October. Investigators identified an unauthorized hardware implant inside one affected wallet that could capture recovery phrases during setup.
<h2 class="wp-block-heading" id="strong-nearly-26-000-keystone-buyers-had-personal-information-exposed-strong">Nearly 26,000 Keystone buyers had personal information exposed</h2>
Keystone’s investigation identified 51,083 purchase records associated with its official Shopify store, although personal information belonging to 25,119 of those records had already been erased before the attack.
The remaining 25,964 records contained customer names, contact information, shipping addresses and order details from purchases made between 2024 and 2026.
Investigators identified another 12,873 incomplete checkout records containing personal information submitted by customers who never completed payment.
Keystone said its data retention procedures contributed to the exposure because an automated deletion tool had failed to remove some customer records within the company’s required 180-day period.
The company acknowledged that it had not detected the failed deletion requests in time, leaving information stored longer than permitted.
Following the investigation, Keystone shortened its customer data retention period to 90 days and submitted deletion requests to Shopify on October 24 for overdue purchase records.
Shopify requires a 10-day waiting period before those requests are finalized, with deletion expected by November 3. Separate requests were submitted for incomplete checkout information retained longer than 30 days.
Customer information leaks have affected other hardware wallet manufacturers this year. In September, crypto.news <a href="https://crypto.news/trezor-bitbox-warn-users-after-phishing-emails-target-wallet-holders/" rel="noopener noreferrer nofollow">reported that Trezor and BitBox</a> had warned customers about phishing emails following security problems involving third party service providers.
Trezor had previously disclosed that a breach involving its shipping provider ShipMonk exposed information belonging to more than 80,000 customers.
<h2 class="wp-block-heading" id="strong-customer-notifications-planned-alongside-more-security-checks-strong">Customer notifications planned alongside more security checks</h2>
Keystone said it blocked the unauthorized access and disabled sensitive website functions on October 20, before fixing the vulnerability and beginning a forensic investigation.
Affected customers will receive individual email notifications, while a planned lookup page will allow users to check whether their information was exposed.
A separate service will eventually let customers confirm whether their personal data has been erased.
The company has warned users against messages offering wallet migration, asset verification or investigation assistance, emphasizing that the incident does not require existing owners to move their cryptocurrency.
Similar impersonation attempts have previously targeted hardware wallet customers. In October, <a href="https://crypto.news/ledger-faces-fake-website-warning-amid-86m-theft-probe/" rel="noopener noreferrer nofollow">fake Ledger websites</a> appeared in sponsored search results and directed users toward fraudulent recovery phrase verification pages.
Keystone has committed to reviewing its data access controls, authentication key management and deletion procedures as part of a security audit.
The company said regulatory and law enforcement reports had already been submitted in the European Union, United Kingdom and other jurisdictions, with more reporting planned wherever required.
Read more: <a href="https://crypto.news/bitmine-adds-10452-eth-as-share-buybacks-approach-400m/" rel="noopener noreferrer nofollow"> Bitmine adds 10,452 ETH as share buybacks approach $400M </a>

Keystone to destroy 18,835 hardware wallets after authentication key breach

Table of Contents

crypto.news

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!