SecurityDeveloping

Keystone to destroy nearly 19,000 devices after website breach exposed authentication key and customer data

Hardware wallet maker suspends shipments, says stolen key could allow counterfeit devices to pass authenticity checks

By LineZotpaper AI staff

Published27 October 2026

Updated27 October 2026

Read Time3 min

Sources2 outlets

Follow this storyHear when it moves

Illustration: Keystone to destroy nearly 19,000 devices after website breach exposed authentication key and customer data

Hardware wallet maker Keystone will destroy 18,835 unsold devices and suspend shipments after a website breach gave attackers access to a key used to verify device authenticity, along with 25,964 buyer records. The company disclosed the full extent of the Oct. 20 attack on Monday, saying the stolen authentication key could allow counterfeit wallets to appear genuine and potentially lead to asset theft.

Keystone announced it will destroy all unsold inventory containing the compromised key and halt production shipments until it can produce devices with a new authentication key.

"These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft," Keystone said in a statement.

The attacker gained access to the company's website on Oct. 20 through a vulnerability in a third-party monitoring tool, Keystone said. The intruder escalated privileges and obtained the authentication key as well as customer information.

The stolen key is built into devices during production and cannot be changed. It allows wallets to pass online authenticity checks, raising the risk that fake devices could be sold as genuine.

Keystone also confirmed the scope of the customer data breach. The company's Shopify store had generated 51,083 buyer records. While 25,119 had been deleted per Keystone's 180-day data retention policy, the remaining 25,964 records dating from 2024 to 2026 were stolen. An additional 12,873 unpaid checkout records may have been affected.

Keystone said the records that should have been deleted were kept because an automated deletion tool failed without the company detecting it. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure," the company wrote.

Devices manufactured and delivered before Oct. 20 remain safe to use if they pass authentication, Keystone said. Customers who received devices after that date should contact support for additional verification. The company said users do not need to move funds due to the breach alone and warned against fake recall or asset migration messages.

Keystone said it will replace the authentication key in new devices, shift website sales to preorders, and cut customer data retention to 90 days.

The incident is the latest in a string of attacks on hardware wallet manufacturers this year. Earlier this month, Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales after devices with unauthorized implants were discovered. In July, Coldcard manufacturer Coinkite warned users after a seed-generation bug led to theft of millions of dollars in crypto.

Separately, Foundation, another hardware wallet maker, disclosed a breach Sunday in which attackers sent phishing emails from its official domains and accessed customer records, though no devices or private keys were compromised.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

Hardware wallets are considered one of the most secure ways to store cryptocurrency. A compromised authentication key undermines trust in the entire verification process, as counterfeit devices could steal users' funds.
The data breach exposed 25,964 buyer records, including names, addresses, and order information, creating a phishing risk for affected customers. Keystone's failure to delete data on time despite its stated policy raises privacy concerns.
The company's decision to destroy nearly 19,000 units represents a significant financial loss and operational disruption, highlighting the real-world consequences of security failures in the crypto hardware industry.

Background

Keystone is a hardware wallet manufacturer that makes devices designed to store cryptocurrency private keys offline. The company's products use an authentication key to verify that devices are genuine, preventing tampering. A breach on Oct. 20 via a third-party monitoring tool gave attackers access to this key, as well as customer data that should have been deleted under a 180-day retention policy. The incident follows a series of security problems at rival manufacturers this year, including Ledger, Coldcard, and Trezor, which have exposed customer data or compromised device integrity.

What to Watch

Whether Keystone can produce new devices with a replaced key and resume shipments without further delays or vulnerabilities.
Any reports of counterfeit Keystone devices appearing for sale, especially targeting customers who received devices after Oct. 20.
Regulatory or legal consequences for Keystone's failure to delete customer data on time, and potential class-action lawsuits from affected buyers.

Sources

Keystone breach deepens: Hackers stole key used to verify wallets as genuine · Cointelegraph
Crypto wallet maker Keystone to destroy almost 19,000 devices after security breach · CoinDesk

Checked

11 claims in this story checked against 2 sources: 9 supported.

Show each claim

SupportedKeystone will destroy nearly 19,000 devices after a breach exposed an authentication key and customer data.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “Keystone will destroy 18,835 unsold hardware wallets after a website breach exposed a key that could let counterfeit devices pass its authenticity checks. The breach exposed 25,964 buyer records”
SupportedKeystone suspended shipments, and said the stolen key could let counterfeit devices pass authenticity checks.Cointelegraph.com News: “In a statement Monday, Keystone said the stolen authentication key could allow attackers to produce counterfeit wallets that pass its authenticity checks.”
SupportedKeystone will destroy 18,835 devices and 25,964 buyer records were stolen.Cointelegraph.com News: “Keystone said it plans to destroy 18,835 devices in its inventory that contain the compromised key”
SupportedThe attack occurred on Oct. 20 and used a vulnerability in a third-party monitoring tool.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “An attacker gained access to the company’s website on Oct. 20 through a flaw in a third-party data monitoring tool, Keystone said Monday in a post on X .”
SupportedKeystone said counterfeit devices might be used as genuine products and potentially result in asset theft.Cointelegraph.com News: ““These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” Keystone said.”
SupportedThe Shopify store generated 51,083 buyer records; 25,119 had been deleted and the remaining 25,964 records dating from 2024 to 2026 were stolen.Cointelegraph.com News: “its website’s Shopify store had generated 51,083 buyer records. Of those, 25,119 had been deleted per its 180-day data retention policy. However, the remaining 25,964 records dating from 2024 to 2026 were stolen by the attacker.”
Reports differAn additional 12,873 unpaid checkout records may have been affected.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “Another 12,873 unpaid checkout records may have been affected.”
SupportedKeystone said it failed to erase customer data on time and accepted responsibility.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: ““We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.”
SupportedDevices manufactured and delivered before Oct. 20 remain safe if they pass authentication; customers who received devices after that date should contact support for additional verification.Cointelegraph.com News: “Keystone said devices manufactured and delivered before the Oct. 20 incident should be considered safe and that their authenticity checks remain trustworthy. However, it could not guarantee the authenticity of devices delivered after that date and urged affected customers to contact its support team for additional verification.”
Partly supportedFoundation attackers accessed customer records, but no devices or private keys were compromised.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “It found no evidence that Passport devices or private keys were compromised. ... attackers could access records containing about 5,600 mailing addresses and 5,200 phone numbers, though it could not confirm how many were accessed.”
SupportedKeystone will replace the key in new devices, shift website sales to preorders and cut data retention to 90 days.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “Keystone will replace the authentication key in new devices, shift website sales to preorders and cut customer data retention to 90 days, it added.”