Keystone to Destroy 18,835 Hardware Wallets After Device Verification Key Is Stolen

Hardware crypto wallet maker Keystone said on October 26 that an attacker who gained access to its website obtained the key its devices use to prove they are genuine. With that key, someone could build counterfeit wallets that pass the online verification check. A buyer who trusted a fake could have their crypto stolen. Owners' recovery phrases and wallet private keys, the company says, were not involved.

Keystone will destroy 18,835 unsold devices carrying the old key, and all new wallets will get a new one.

How the breach happened

The unauthorized access was discovered on October 20. The attacker exploited a vulnerability in a third-party data monitoring tool used on the company's website, escalated privileges, and obtained customer data and the key. Access was blocked the same day and the vulnerability has since been fixed. The company has not said when the attacker first got in or where the key was stored.

Why the key can't simply be replaced

To verify a device, the owner scans a QR code on Keystone's site with the wallet and enters the code the device displays. In the open-source firmware, the QR code carries that code in encrypted form, and the device decrypts it with its stored key. The key is used only for this check and plays no part in generating recovery phrases or signing transactions.

The key is written during manufacturing into one-time programmable memory, and the firmware refuses to accept a second one. Devices already made therefore cannot be switched to the new key. The company has not reported any counterfeits or thefts.

Customer data exposed

The breach affected 25,964 records of purchases from Keystone's Shopify-based store between 2024 and 2026: names, contact details, shipping addresses, and order details. Payment data and ID numbers were not involved, nor were orders through Amazon or other channels. As a precaution, the company also included 12,873 unpaid checkout records.

Some of the data should have been gone long ago: Keystone promised to delete shipping information 180 days after each order, but its own bulk-deletion tool was unreliable and the failures went unnoticed. Retention has now been cut to 90 days, though as of October 27 the privacy policy still said 180.

What owners should do

• Device delivered before October 20 that passes the check: use it normally.
• Device with the old key received after October 20: don't use it until Keystone support confirms it is genuine. The company hasn't explained how to tell which key a device carries.
• Orders from the website are paused until new-key devices are ready; the Keystone 3 Pro is on pre-order, shipping in 4 to 6 weeks.
• The same guidance applies to devices bought on Amazon or from resellers.
• There is no need to move funds solely because of the incident.

Keystone also warns that any offer of a refund, replacement, recall, or "wallet verification" should be treated as a scam. The company will not ask anyone to return a device, and a recovery phrase should never be entered into a wallet you did not order.

Source: The Hacker News