Keystone will destroy 18,835 hardware wallets after an attacker stole the authentication key used to verify whether its devices are genuine, creating a risk that counterfeit wallets could pass the company’s online checks. The hardware-wallet maker disclosed the incident in an security statement published October 26 and said it had suspended shipments of affected inventory. [21]
The breach was detected on October 20, when Keystone said its monitoring systems identified unusual access to the company’s official website. According to the company, the attacker exploited a vulnerability in a third-party data-monitoring tool to escalate privileges, gaining access to customer information and the device-authentication key. Keystone said it disabled sensitive website functions, blocked the unauthorized access and fixed the vulnerability the same day. [21]
The exposed key is used by Keystone’s device-verification service to authenticate hardware wallets. An attacker holding it could potentially manufacture counterfeit devices that pass the authenticity check, allowing a victim to trust a tampered wallet and potentially expose cryptocurrency. Keystone said the key is provisioned during manufacturing and cannot be erased or rewritten, which is why all 18,835 affected units in existing inventory will be destroyed rather than updated. [4][10]
Keystone said devices delivered before October 20 were delivered before the incident and can continue to be verified through the company’s normal process. Customers who received devices after that date should contact Keystone support before using them if they contain the old key: the company warned that passing the online check alone cannot completely rule out counterfeiting. New orders are being accepted as preorders, with devices using a replacement key expected to ship within four to six weeks. [1]
The incident also involved 51,083 buyer records from the company’s Shopify store, Keystone said. Of those, 25,964 still contained personal information, including names, contact details, shipping addresses and order information from 2024 through 2026. The company said recovery phrases, private keys, wallet credentials, payment information and government identification numbers were not exposed. [21]
Keystone has not publicly identified a CVE, published a CVSS rating or attributed the intrusion to a named threat actor, and there is no verified public report of exploitation in the wild tied to the stolen key. Users should avoid moving funds solely because of the disclosure, but should treat any post-October 20 device using the legacy authentication key as requiring additional verification from Keystone and remain alert for phishing or fake-recall messages targeting affected buyers.
References
- Keystone Hardware Wallet
- Device Verification | Keystone Hardware Wallet
- Keystone Breach Deepens as 18835 Crypto Hardware …
- Keystone Updates Security Incident Response Progress: 18,835 Devices with Old Keys to Be Destroyed, Customer Information Retention Period Shortened to 90 Days
