Key Takeaways
- Keystone will destroy 18,835 hardware wallets after attackers stole its device authentication key.
- Keystone confirmed 25,964 buyer records retained personal information exposed in the breach.
- The firm suspended shipments and warned that counterfeit devices could pass authentication.
Stolen Authentication Key Forces Keystone to Scrap 18,835 Wallets
What initially appeared to be a customer information breach has developed into a considerably more serious security problem. On Oct. 26, 2026, Keystone disclosed that attackers also obtained the authentication key used to establish whether its hardware wallets are genuine.
The company traced the intrusion to a vulnerability in a third-party data monitoring tool that allowed attackers to escalate their access privileges. Keystone detected suspicious activity Oct. 20, disabled vulnerable website functions, and launched a forensic investigation.
The stolen WebAuth key presents a particularly uncomfortable problem. An attacker possessing it could manufacture counterfeit devices capable of passing Keystone’s authenticity checks, potentially exposing unsuspecting buyers to asset theft.
Keystone explained that the key is permanently embedded during manufacturing and cannot be rewritten or erased. Consequently, the hardware wallet manufacturer plans to destroy all 18,835 devices in the existing inventory containing the compromised key. Newly manufactured wallets will receive a replacement authentication key. Meanwhile, Keystone has suspended shipments of outstanding website orders and switched to preorders until replacement production is ready.
Nearly 26,000 Buyer Records Exposed as Data Deletion System Fails
The investigation also exposed a serious failure in Keystone’s customer data management. Of 51,083 Shopify buyer records examined, 25,964 retained personal information, including names, shipping addresses, contact details, and purchase histories dating from 2024 through 2026. Keystone acknowledged that its automated deletion system had malfunctioned, allowing customer information to remain stored beyond its 180-day retention policy.
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company stated.
Investigators also identified 12,873 unpaid checkout records containing potentially sensitive customer information. Keystone has included those records in its response and initiated additional deletion requests. The manufacturer has shortened its retention period to 90 days, and expects overdue buyer data deletion requests submitted Oct. 24 to be finalized Nov. 3. Keystone’s latest postmortem report follows the disclosure from Foundation, a hardware wallet maker from Boston who also suffered a customer data breach.
Existing Wallet Owners Receive New Security Guidance
Keystone maintains that recovery phrases, private keys, wallet credentials, and payment information were not compromised. Customers aren’t being instructed to move their cryptocurrency solely because of the incident. Devices delivered before Oct. 20 remain safe to use if they pass authentication, the company says. Devices received afterward using the compromised key require additional verification through customer support, even if authentication succeeds.
Keystone also warned customers against fraudulent recall messages requesting device returns. The company has submitted regulatory reports in the EU, U.K., and other jurisdictions, with plans to introduce breach lookup tools and conduct further security audits. For a manufacturer selling devices designed to eliminate trust in third-parties, losing the key that establishes trust in its own hardware presents a particularly difficult contradiction.
