CoinDesk
Keystone will destroy 18,835 unsold hardware wallets and suspend shipments after an October 20 website breach exposed a production key used for device authentication. The attack also exposed 25,964 buyer records from 2024 through 2026, including names, contact details, shipping addresses and order information. Another 12,873 unpaid checkout records may have been affected.
Why it matters
The stolen key is built into devices during production and cannot be changed. It could allow counterfeit wallets to pass Keystone's online authenticity checks, creating a supply-chain risk even though the company said recovery phrases, private keys and wallet credentials were not exposed.
Keystone said the breach came through a flaw in a third-party data monitoring tool. The incident also revealed that some customer records remained past the company's 180-day deletion policy after an automated deletion tool failed without detection. Keystone accepted responsibility and said it will cut retention to 90 days.
The disclosure follows separate incidents involving other hardware-wallet companies. Foundation reported more than 23,000 phishing attempts and database copies containing thousands of mailing addresses and phone numbers. Ledger users in Southeast Asia received devices with hidden components that captured recovery phrases, while a Coldcard seed-generation flaw allowed private-key reconstruction.
Market impact
Keystone said devices delivered before October 20 remain safe to use if they pass authentication, while customers who received devices using the old key after that date should seek additional checks. The company said users do not need to move funds because of this breach alone and warned against fake recall or asset-migration messages.
Keystone plans to replace the authentication key in new devices and shift website sales to preorders. The broader impact is a higher security and trust burden for hardware-wallet makers, especially around device provenance, data retention and phishing-resistant customer communications.
Frequently asked questions
-
What did the Keystone breach expose?
The breach exposed 25,964 buyer records from 2024 through 2026, including names, contact details, shipping addresses and order information. Another 12,873 unpaid checkout records may have been affected.
-
Why is the exposed Keystone key a security risk?
The key is built into devices during production and cannot be changed. It could allow counterfeit hardware wallets to pass Keystone's online authenticity checks.
-
Were Keystone users' private keys or recovery phrases exposed?
Keystone said the breach did not expose recovery phrases, private keys or wallet credentials.
-
What happened to Keystone's customer data deletion process?
Some records remained beyond Keystone's 180-day deletion policy after an automated deletion tool failed without the company detecting the issue. Keystone plans to reduce retention to 90 days.
-
What should Keystone customers do after the breach?
Keystone said users do not need to move funds because of the breach alone. Customers who received devices using the old key after October 20 should seek additional checks and avoid fake recall or asset-migration messages.
CryptoSlate
CoinTelegraph
WuBlockchain
TheBlock
Lookonchain
WatcherGuru