2024

2026

would

Status

<p>The manufacturer of hardware crypto wallets Keystone announced on October 26, 2026 the destruction of 18,835 unsold devices. Added to this is the suspension of shipments after its site was hacked on October 20. According to Keystone, the crypto hacker obtained a key that would allow counterfeit devices to pass the brand’s authenticity checks as well as 25,964 buyer records.</p>
<div class="in-brief">
 <div class="in-brief--container"><span></span><span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>18,835 unsold crypto wallets will be destroyed and shipments are suspended (Keystone, October 26, 2026).</li>
   <li>The site was hacked on October 20 via a third-party data tracking tool: 25,964 buyer records from 2024 to 2026 are exposed.</li>
   <li>An authenticity key engraved during manufacturing, unmodifiable, was exposed: it could allow counterfeits to pass as authentic devices.</li>
  </ul>
 </div>
</div>
<h2 id="h-what-happened-during-the-keystone-hack">What happened during the Keystone hack?</h2>
<p>A <a href="https://www.cointribune.com/en/the-end-of-crypto-cold-wallets-after-keystone-coldcard-ledgerhack/" rel="noopener noreferrer nofollow">crypto hacker</a> accessed the Keystone site on October 20, 2026 through a vulnerability in a third-party data tracking tool. The intrusion <strong>exposed 25,964 buyer records covering 2024 to 2026</strong>:</p>
<div class="my-4">
 <div class="ads "></div>
</div>
<ul>
 <li>names&nbsp;;</li>
 <li>contact details&nbsp;;</li>
 <li>delivery addresses&nbsp;;</li>
 <li>order information.</li>
</ul>
<p>Keystone adds that 12,873 unpaid order records may have been affected. Adding the two figures, there are <strong>up to 38,837 records concerned</strong> by this crypto hack. The company firmly asserts that recovery phrases were not exposed. The same goes for private keys and crypto wallet IDs. However, this claim has not been confirmed by an independent source.</p>
<div class="tweet">
 <blockquote class="twitter-tweet"><a href="https://twitter.com/KeystoneWallet/status/2114719318722404578%20?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow"></a>
 </blockquote>
</div>
<h2 id="why-is-keystone-destroying-18-835-unsold-crypto-wallets">Why is Keystone destroying 18,835 unsold crypto wallets?</h2>
<p>Keystone is destroying 18,835 unsold crypto wallets because <strong>the exposed authenticity key is integrated into each device during production</strong>. It therefore cannot be modified. An authenticity key is a secret identifier engraved in the device, which online checks verify to confirm its origin. With it, counterfeit devices could pass for authentic.</p>
<p>The <strong>18,835 crypto wallets have not yet been sold</strong>. This allows Keystone to remove them before they reach customers. At this stage, Keystone does not specify whether counterfeit devices are already in circulation.</p>
<p>Regarding data retention, Keystone admits a failure. An <a href="https://www.cointribune.com/en/crypto-en/crypto-tools-en/" rel="noopener noreferrer nofollow">automatic deletion tool</a> indeed broke down without the company detecting it, thus leaving records beyond the 180-day limit.</p>
<blockquote class="wp-block-quote">
 <p><em>We did not fulfill our commitment to delete customer data on time, and we take responsibility for this failure.</em></p><cite><em>Keystone, hardware wallet manufacturer, post on X, October 26, 2026 (translated from English)</em></cite>
</blockquote>
<figure class="wp-block-table">
 <table>
  <tbody>
   <tr>
    <td><strong>Item</strong></td>
    <td><strong>Volume</strong></td>
    <td><strong>Status according to Keystone</strong></td>
   </tr>
   <tr>
    <td>Buyer records (2024 to 2026)</td>
    <td>25,964</td>
    <td>Exposed: names, contact details, addresses, orders</td>
   </tr>
   <tr>
    <td>Unpaid order records</td>
    <td>12,873</td>
    <td>May have been affected</td>
   </tr>
   <tr>
    <td>Authenticity key</td>
    <td>1 key, unmodifiable</td>
    <td>Exposed</td>
   </tr>
   <tr>
    <td>Recovery phrases, private keys</td>
    <td>Not specified</td>
    <td>Not exposed</td>
   </tr>
  </tbody>
 </table>
 <figcaption><em>Source: Keystone, post on X of October 26, 2026; data recorded on 10/27/2026.</em>
 </figcaption>
</figure>
<h2 id="what-does-this-crypto-incident-change-for-a-buyer-in-france">What does this crypto incident change for a buyer in France?</h2>
<p>According to Keystone, <strong>crypto wallets delivered before October 20, 2026 remain safe</strong> if they pass authentication. Customers who received after this date a device equipped with the old key must however have it checked before any use. Keystone adds that users also do not need to move their funds solely because of this intrusion.</p>
<p>The company also commits to <strong>replace the authenticity key in new crypto wallets</strong>. And not only that! It will switch the site’s sales to preorders and reduce customer data retention to 90 days, compared to 180 days today (i.e. half as much).</p>
<p>Good to know: another manufacturer, Foundation, <a href="https://x.com/FoundationHQ/status/2114743519852069110" rel="noopener noreferrer nofollow">reported</a> the day before a distinct breach. The company recorded <strong>more than 23,000 crypto phishing attempts</strong> from addresses that seemed official. It found no evidence of compromise of Passport devices nor private keys. Old database copies escaped its 60-day deletion: about 5,600 postal addresses and 5,200 phone numbers are accessible, without Foundation being able to confirm how many were accessed.</p>
<div class="affiliate-button"><a href="https://shop.ledger.com/?r=92612fa61702" rel="noopener noreferrer nofollow">Secure your cryptos with Ledger</a><a href="https://www.cointribune.com/en/sponsored-content/" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<p>Both <a href="https://www.cointribune.com/en/tag/piratage-en/" rel="noopener noreferrer nofollow">crypto hacks</a> primarily affect sales data, with Keystone also having an authenticity key exposed. Moreover, a planned deletion did not occur in either case. It remains to be seen whether counterfeit devices carrying the old key will appear and if Keystone will detail its investigation, with no date announced yet. For a buyer in any case, the challenge in the coming weeks will be to verify the authenticity of a new crypto wallet with its manufacturer or an official reseller.</p>
<div class="my-4">
 <div class="ads "></div>
</div>

Keystone to Destroy 18,835 Crypto Wallets After Hack

Table of Contents

Cointribune EN

Other articles published on Oct 27, 2026

Join our free newsletter for daily crypto updates!