Keystone to destroy 18,835 hardware wallets after authentication key breach

Hardware wallet manufacturer Keystone has confirmed that hackers stole a device authentication key and exposed personal information belonging to 25,964 customers, forcing the company to destroy 18,835 devices and suspend shipments.

According to the company’s October 26 security announcement, attackers gained unauthorized access to its official website on October 20 by exploiting a vulnerability in a third party data monitoring tool, which allowed them to obtain customer records and the key used to verify whether Keystone devices are genuine.

The company said recovery phrases, private keys, wallet credentials, banking information and government identification numbers were not compromised. However, the stolen authentication key could allow attackers to manufacture counterfeit devices that pass Keystone’s official authenticity checks.

Keystone has stopped using the compromised key in manufacturing and will replace it with a new one. Existing inventory containing the old key will be destroyed, while pending orders will remain on hold until replacement devices are ready.

Keystone authentication key breach forces device destruction

The stolen credential, known as the WebAuth key, is embedded into Keystone hardware wallets during manufacturing and is used when customers check their devices through the company’s authentication website.

Keystone explained that the key cannot be erased or rewritten once it has been installed. Although it has no role in generating recovery phrases, deriving private keys or signing transactions, its exposure creates a problem with the company’s device verification process.

Attackers possessing the key could potentially produce counterfeit wallets capable of passing the authentication checks that customers normally use to confirm whether their devices are legitimate.

As a precaution, Keystone will destroy all 18,835 devices currently in inventory that contain the compromised key. Production has switched to a replacement authentication key, and the company has suspended shipments of unfulfilled orders placed through its website.

Sales will continue through a preorder model until manufacturing and shipping can resume.

Keystone said devices delivered before October 20 remain safe to use if they pass authentication. However, customers who received devices after that date containing the old key have been advised to contact support for additional verification before using them.

The company has ruled out asking customers to return their wallets and warned that anyone requesting devices under the pretext of an official recall should be treated as a scammer.

The warning comes after Ledger investigated compromised devices distributed through a Southeast Asian reseller in October. Investigators identified an unauthorized hardware implant inside one affected wallet that could capture recovery phrases during setup.

Nearly 26,000 Keystone buyers had personal information exposed

Keystone’s investigation identified 51,083 purchase records associated with its official Shopify store, although personal information belonging to 25,119 of those records had already been erased before the attack.

The remaining 25,964 records contained customer names, contact information, shipping addresses and order details from purchases made between 2024 and 2026.

Investigators identified another 12,873 incomplete checkout records containing personal information submitted by customers who never completed payment.

Keystone said its data retention procedures contributed to the exposure because an automated deletion tool had failed to remove some customer records within the company’s required 180-day period.

The company acknowledged that it had not detected the failed deletion requests in time, leaving information stored longer than permitted.

Following the investigation, Keystone shortened its customer data retention period to 90 days and submitted deletion requests to Shopify on October 24 for overdue purchase records.

Shopify requires a 10-day waiting period before those requests are finalized, with deletion expected by November 3. Separate requests were submitted for incomplete checkout information retained longer than 30 days.

Customer information leaks have affected other hardware wallet manufacturers this year. In September, crypto.news reported that Trezor and BitBox had warned customers about phishing emails following security problems involving third party service providers.

Trezor had previously disclosed that a breach involving its shipping provider ShipMonk exposed information belonging to more than 80,000 customers.

Customer notifications planned alongside more security checks

Keystone said it blocked the unauthorized access and disabled sensitive website functions on October 20, before fixing the vulnerability and beginning a forensic investigation.

Affected customers will receive individual email notifications, while a planned lookup page will allow users to check whether their information was exposed.

A separate service will eventually let customers confirm whether their personal data has been erased.

The company has warned users against messages offering wallet migration, asset verification or investigation assistance, emphasizing that the incident does not require existing owners to move their cryptocurrency.

Similar impersonation attempts have previously targeted hardware wallet customers. In October, fake Ledger websites appeared in sponsored search results and directed users toward fraudulent recovery phrase verification pages.

Keystone has committed to reviewing its data access controls, authentication key management and deletion procedures as part of a security audit.

The company said regulatory and law enforcement reports had already been submitted in the European Union, United Kingdom and other jurisdictions, with more reporting planned wherever required.