Quick Takeaways
- Authentication key exposed: Attackers could make counterfeit Keystone wallets pass verification, but recovery phrases and private keys were not compromised; no thefts have been reported.
- Customer data affected: 25,964 buyer records and 12,873 abandoned checkouts may have exposed names, contact details, addresses, and order information—not payment or government ID data.
- Keystone’s response: The company fixed a third-party-tool vulnerability, will destroy 18,835 unsold devices with the old key, and is issuing new keys for future devices.
- What owners should do: Pre–Oct. 20 devices that pass verification can be used normally. If your device arrived after Oct. 20 and has the old key, don’t use it until Keystone confirms it’s genuine; beware of scam messages.
Keystone to Destroy 18,835 Hardware Wallets After Verification Key Theft
A Trust Check Becomes a Security Risk
Keystone says a hacker accessed its website and stole the key used to verify that its hardware wallets are genuine. The company discovered the breach on October 20 and blocked the access that day. It says the attacker exploited a weakness in a third-party monitoring tool.
The key supports a device check. It does not create recovery phrases or private keys, and it cannot authorize crypto transactions. However, someone with the key could make a counterfeit device pass the check. A buyer who trusted one could risk losing crypto. Keystone has not reported counterfeit devices or thefts.
Because the key cannot be replaced in devices already made, Keystone will destroy 18,835 unsold units that contain it. New devices will use a different key. The company has also paused website orders until updated devices are ready.
What Customers Should Know
Keystone says owners who received a device before October 20 can use it normally if it passes the check. Those who received a device after that date with the old key should contact support and wait for confirmation before using it. The company has not explained how customers can identify which key their device holds.
The breach also exposed records for 25,964 website buyers, plus 12,873 unfinished checkouts. The records included contact, shipping and order details, but not payment information or government ID numbers. Keystone says purchases through Amazon and other sales channels were not affected.
Keystone will reduce how long it keeps customer information from 180 days to 90 days. It says an automated deletion system failed to remove some older records. The incident highlights a practical challenge for crypto users: hardware wallets can help protect digital assets, but customers still rely on companies to secure devices and personal data.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
DataProtection-V1
