Hardware wallet maker Keystone said in an October 26 post on X that it will destroy 18,835 devices sitting in its inventory after the intruder behind its website breach also obtained the WebAuth key that underpins its device-authenticity checks.
The danger lies in how the key works. Keystone burns it into its devices during manufacturing and cannot erase or rewrite it later. Anyone holding a copy could make counterfeit devices the company’s own verification page would vouch for, which Keystone said could end in stolen funds. That is why it is switching factory production to a fresh key, freezing shipments of website orders it hasn’t sent, and selling new units only as preorders until new-key devices are built.
The key has no role in creating recovery phrases, deriving private keys or signing transactions, according to Keystone.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Which Devices to Trust
Keystone said devices delivered before October 20, the day its monitoring flagged unusual access to the site, can be trusted if they pass authentication. For devices received after that date that still carry the old key, “we cannot completely rule out the possibility that it is counterfeit,” even when the check passes, the company said, and it asked those owners to reach support before using them. Keystone said it will not ask anyone to send a device back and that “recall” requests of that kind are scams.
Records Kept Past Deadline
The statement also put numbers on the customer data exposure Keystone first disclosed on October 24. The intrusion touched 51,083 buyer records from its Shopify store. Personal details tied to 25,119 of them had already been wiped, but 25,964 records from 2024 to 2026 still held names, contact details, shipping addresses and order information. A further 12,873 checkout records for purchases that were never paid also held names plus contact and shipping details, though Keystone said some of those details may not have been complete or accurate. It asked Shopify on October 24 to erase personal data in checkout records kept more than 30 days.
Keystone said its policy calls for erasing buyer records after 180 days, but a bulk-erasure tool it built “did not operate reliably,” and the failed jobs weren’t caught in time, so some of that personal data stayed on file past the deadline. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” it said. Keystone said the overdue-data requests should be complete on November 3 after a 10-day waiting period. The statement describes those requests as covering data past “the 90-day retention period,” the shorter limit Keystone said it is now adopting in place of 180 days.
The company traced the intrusion to a flaw in a third-party data monitoring tool on its website, which it did not name, and said recovery phrases, private keys, bank payment details and government ID numbers were not involved. It said it has filed reports in the EU, the UK and other jurisdictions.
Related Listen: The Chopping Block: Black October, Banks Blocking AI Agents, Hyperliquid’s Blockchain-Not-Bitcoin Moment, and the Visa-Fireblocks Rumor
The post Keystone Halts Web Orders, Will Junk 18,835 Wallets in Stock Over Stolen Authenticity Key appeared first on Unchained.