Keystone to Destroy 18,835 Hardware Wallets After Attacker Steals Device Authentication Key

Keystone, the maker of air-gapped crypto hardware wallets, said an attacker breached its official website and stole both customer data and the cryptographic key it uses to certify that its devices are genuine. The company said in a statement on X on October 26 that it will destroy 18,835 devices in inventory that carry the compromised key and has suspended shipping on all unshipped website orders.

Keystone said its monitoring systems detected unusual access on October 20. Its first disclosure on October 25 confirmed only that customer shipping information had been taken, and the theft of the authentication key emerged in the fuller report a day later. The attacker exploited a vulnerability in a third-party data monitoring tool used by the site to escalate privileges, which gave them access to buyer records held in the company's Shopify store and to the "WebAuth" key behind its device authentication page .

The key is the more serious loss. It is written into each device during manufacturing and cannot be erased or rewritten, and Keystone said whoever holds it could produce counterfeit wallets that pass its authenticity check. A tampered device sold to an unsuspecting buyer could then be used to steal funds. The key plays no role in seed phrase generation, key derivation or transaction signing, and Keystone said recovery phrases and private keys were not exposed.

The company said devices delivered before October 20 are unaffected and can be trusted if they pass authentication. Anyone who received a device carrying the old key after that date should contact support for additional verification before using it, since passing the check no longer rules out a counterfeit. New production will use a fresh key, and website sales have moved to preorders until those devices are ready.

The data side of the breach traces back to Keystone's own process failure. Of 51,083 buyer records from its Shopify store, 25,964 still contained names, contact details, shipping addresses and order information covering 2024 to 2026. Under the company's 180-day retention policy, those records should have been deleted, but an automated bulk-erasure tool it built to work around Shopify's manual deletion process failed intermittently and the failures went undetected. A further 12,873 abandoned checkout records with names and shipping details were also exposed. Orders through Amazon and other channels were not affected.

Keystone said it has asked Shopify to erase the overdue data, with completion expected on November 3, cut its retention period to 90 days, and filed reports with regulators in the EU, the UK and other jurisdictions.

Keystone is the second hardware wallet maker in three months to leak customer shipping data through an add-on to its online store. SafePal disclosed on August 16 that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses and phone numbers of roughly 39,798 customers, and later said people were claiming to sell the dataset, a claim it could not verify. That incident stopped at personal data, while Keystone's attacker also walked away with the means to pass off counterfeit hardware as genuine.

Hardware wallet buyers have seen where leaked shipping data can lead. Ledger's 2020 e-commerce breach ended with the names, postal addresses and phone numbers of roughly 272,000 customers dumped online, fuelling years of phishing campaigns and threats against holders at their homes. Keystone has warned customers to ignore any message offering "asset migration" or "wallet verification", and said it will never ask users to return a device under the pretext of a recall.