Cryptocurrency hardware wallet maker Keystone is set to destroy 18,835 unsold devices after an attacker obtained a cryptographic key used to verify the authenticity of its hardware wallets.
In a statement published on October 26, the company said an attacker gained access to its website infrastructure and obtained the key used by devices to prove they are genuine. The exposed key could allow criminals to manufacture counterfeit wallets that pass Keystone’s online authentication checks, potentially putting customers’ cryptocurrency at risk.
Keystone said the incident did not expose users’ wallet private keys or recovery phrases. However, a counterfeit device carrying the compromised key could pass the company’s verification process and potentially be used to steal cryptocurrency from unsuspecting buyers.
The company discovered unauthorized access on October 20 and said it subsequently blocked the attacker’s access and fixed the vulnerability. According to Keystone, the attacker exploited a flaw in a third-party data monitoring tool used by its website to gain elevated privileges and access customer information and the authentication key.
Keystone has not disclosed when the attacker first gained access or where the compromised key was stored.
The company said the affected authentication key cannot be erased or replaced on devices that have already been manufactured. As a result, it plans to destroy 18,835 unsold hardware wallets containing the old key and use a new key for all newly manufactured devices.
Keystone’s authentication system relies on a verification process in which users scan a QR code displayed by their device on the company’s verification page and enter a code generated by the device. The process checks whether the hardware possesses the expected cryptographic key.
Because the attacker obtained that key, counterfeit devices equipped with it could potentially generate valid authentication responses. Keystone warned that passing the verification check alone may not be enough to establish that certain devices are genuine.
The company has issued different recommendations depending on when customers received their devices. Hardware wallets delivered before October 20 that successfully pass authentication can be considered genuine and used normally, according to Keystone.
However, customers who received a device after October 20 that still contains the old key should contact Keystone support and avoid using it until the company confirms its authenticity. Keystone has not reported any confirmed counterfeit devices or cryptocurrency thefts linked to the incident.
The breach also exposed customer information associated with purchases made through Keystone’s website. On October 24, the company initially disclosed that a third party had accessed customers’ shipping information.
Two days later, Keystone said the incident affected 25,964 buyer records from purchases made between 2024 and 2026. The information included names, contact details, shipping addresses, and order details stored and managed through Shopify.
The company said payment card details, bank information, and government identification numbers were not affected. Purchases made through Amazon and other sales channels were also excluded from the exposed purchase records.
Keystone has additionally included 12,873 abandoned checkout records in its response as a precaution. These records contain contact and shipping information entered by customers who did not complete their purchases.
The incident also revealed problems with the company’s data retention practices. Keystone had previously promised to delete shipping information 180 days after an order, but an automated tool designed to remove records in bulk did not work reliably. Some deletions failed, and the company did not detect the failures in time.
In response, Keystone is reducing its customer data retention period from 180 days to 90 days. The company has asked Shopify to delete personal information older than 90 days and expected the process to be completed by November 3.
Keystone said it is contacting affected customers by email and plans to provide a webpage where users can check whether their information was involved in the breach.
Customers waiting for orders placed through Keystone’s website may also experience delays, as the company has paused shipping until devices equipped with the replacement authentication key are ready. As of October 27, the Keystone 3 Pro was listed as a pre-order expected to ship within four to six weeks.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The company has advised customers to remain cautious of fraudulent messages related to the incident. Criminals could exploit the breach by sending fake refund offers, replacement notices, or requests to verify wallets and transfer cryptocurrency.
Keystone said customers should never share their recovery phrases or enter them into an untrusted device. Users should also avoid following suspicious links and instead navigate directly to the company’s official website for updates and support.
