The Keystone wallet breach has prompted the cryptocurrency hardware wallet maker to plan the destruction of 18,835 unsold devices after attackers obtained a key used to verify whether its products are genuine. Keystone has suspended shipments of unfulfilled website orders while it prepares replacement devices.

Key Takeaways

  • The stolen authentication key could allow counterfeit wallets to pass Keystone’s verification process.
  • The company identified 38,837 potentially exposed purchase and checkout records, which do not necessarily represent unique individuals.
  • Keystone said recovery phrases, private keys, passwords and payment information were not compromised.

Why the Keystone wallet breach affects unsold devices

In an October 26, 2026 investigation update, Keystone said attackers had accessed its WebAuth device-authentication key during an October 20 breach of its online store. The company said the attackers exploited a vulnerability in a third-party data-monitoring tool connected to the website.

The key is embedded in wallets during manufacturing and cannot be erased or rewritten afterward. Keystone plans to destroy the affected inventory rather than distribute devices whose authenticity could become difficult to establish. Future production will use a newly generated key.

Keystone said the credential cannot generate recovery phrases, derive private keys or authorize transactions. However, an attacker with the key could potentially make a counterfeit device appear legitimate during verification.

Advice for existing wallet owners

Keystone said wallets received and authenticated before October 20 remain safe to use. It advised customers who received devices containing the older key after that date to contact official support for additional verification.

The company said it is not conducting a physical recall and will not ask customers to return existing wallets. It has moved to a preorder model while preparing replacement devices.

Customer information exposed

Keystone identified 25,964 purchase records that still contained identifiable customer information, alongside 12,873 incomplete checkout records containing names, contact details and shipping information. The combined 38,837 records do not necessarily correspond to the same number of people.

The company said its automated deletion system had failed to consistently enforce its advertised 180-day retention policy. It has shortened the retention period to 90 days and submitted deletion requests for overdue records, which were expected to be completed by November 3 under Shopify’s processing timetable.

Keystone plans to notify affected customers individually and introduce a service for checking whether their information was exposed. It said it had notified regulators and law enforcement in relevant jurisdictions, including the European Union and United Kingdom.

Next milestone

The next stated milestone is the expected completion of overdue data-deletion requests by November 3.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.