Keystone Hardware Wallet Breach: Stolen Key Enables Fakes

Key takeaways

• Keystone is destroying 18,835 unsold hardware wallets and has suspended shipping after an attacker obtained the WebAuth key used to verify device authenticity.
• Keystone says the WebAuth key is written into devices at manufacture and cannot be erased or rewritten, which is why unsold stock cannot simply be fixed.
• Keystone states the stolen key plays no part in recovery phrase generation, private key derivation or transaction signing.
• The breach exposed 25,964 Shopify buyer records from 2024 to 2026 containing names, contact details, shipping addresses and order information, according to Decrypt.
• Keystone says it will never ask customers to send back their devices, and anyone requesting this under a recall pretext is a scammer.

What Keystone disclosed

Keystone is destroying 18,835 unsold hardware wallets and has paused shipping, Decrypt reported on October 27. The cause is a breach of the company's website in which an attacker obtained the permanent factory key used to confirm that a device is genuine. In a statement published on X on October 26, Keystone called it the WebAuth key, which its authentication page uses to check devices.

The company says the key is burned into each device during manufacturing and cannot be erased or rewritten. That detail explains the destruction order. Stock built with the compromised key cannot be repaired, so Keystone plans to produce new devices with a fresh key. Until those exist, website sales are switching to preorders, according to Decrypt and Unchained.

Why a stolen authenticity key matters

Keystone is clear on what the key does not do. It says the WebAuth key has no role in generating recovery phrases, deriving private keys or signing transactions. On the company's account, funds on devices already in customers' hands are not exposed by this theft.

The risk lies elsewhere. Keystone warned that someone holding the key could build counterfeit devices that pass its authentication check. Those could be sold or shipped to buyers who treat them as genuine and might then lose assets. A counterfeit that passes verification is a useful tool for a thief because the buyer has done what they were told to do and still receives a compromised product.

This is our reading rather than a statement from Keystone: for devices carrying the old key, a passed authenticity check now carries much less weight. Owners who bought directly and have used their device normally have little reason to panic. People buying a Keystone secondhand or from an unofficial reseller should be far more careful, since the check that used to reassure them can be forged. Our earlier piece on the hardware wallet supply chain covers why this class of risk is hard to close.

The customer data side

The same incident reached buyer data. Decrypt reports the breach involved 51,083 Shopify buyer records. Of those, 25,119 had already been erased, leaving 25,964 records from 2024 to 2026 that still held names, contact details, shipping addresses and order information. Forklog says these came from orders placed on Keystone's official site, and Decrypt says purchases through Amazon and other channels were not affected. Protos adds that roughly 13,000 incomplete-purchase records with partial order information were also caught, a figure Decrypt does not mention.

Keystone's own policy was to delete buyer records after 180 days, but its automated bulk-deletion tool did not work reliably. The company said it failed to meet its commitment to erase data on time. It has cut retention to 90 days and asked Shopify on October 24 to erase all overdue data. Shopify's process has a 10-day waiting period, and Keystone expects it to finish on November 3.

For holders, leaked shipping addresses matter because they show who bought a crypto device and where they live. We looked at that exposure in our earlier analysis of what the leaked addresses mean.

How the attack happened and what is still unclear

Forklog reports Keystone detected suspicious site access on October 20. Blockhead says the company confirmed on October 23, after checking API activity with Shopify, that a third party had taken customer shipping information. Blockhead also reports the attacker exploited a vulnerability in a third-party data monitoring tool to escalate privileges, which opened the way to both the buyer records and the WebAuth key.

Several points remain open. Keystone has not said who is responsible or when the attacker first got in, according to Decrypt. The sources also disagree on when the first public disclosure occurred: Decrypt and Unchained put it on October 24, while Blockhead says October 25. Keystone says it has filed reports with authorities in the EU, UK and other jurisdictions.

What owners and buyers should do

Keystone has warned about follow-on scams offering "asset migration," "wallet verification" or "investigation assistance." It says it will not ask users to return their devices, and that anyone demanding a device be shipped under a "recall" is a scammer. With names and addresses in the hands of an attacker, expect convincing phishing by email, text and post.

• Treat unsolicited contact referencing your Keystone order as hostile, whatever the branding.
• Never enter a recovery phrase into a website, form or chat because of this incident.
• Buy replacement or additional devices only from the manufacturer's official channels, and expect preorder delays.
• Avoid used or third-party-listed devices with this brand until new-key units are available.

Position sizing and storage discipline also apply here, as covered in our guide to crypto risk management. Spreading holdings across more than one wallet limits the damage if any one device or vendor fails.

Market impact and the wider picture

XPERTRAX data shows Bitcoin at $80,926, up 1.52% over 24 hours, and Ethereum at $2,355, up 1.84%. Nothing in those moves points to stress from this incident, which is limited to one vendor and, by Keystone's account, does not touch private keys. We would not expect price effects.

The bigger consequence is for trust in hardware wallet makers. Decrypt notes that Trezor and SafePal each disclosed customer-data breaches in August 2026. It puts Trezor at 13,689 customers and SafePal at about 39,798, while Yahoo Tech gives 80,689 for Trezor, so that figure is disputed. Keystone's case differs because it involved a non-rotatable device secret rather than only contact details. In our view, vendors will face pressure to show how authentication keys are stored, how data is deleted, and what happens when a manufacturing-time secret leaks. Buyers can reasonably ask the same questions before their next purchase.

Sources

• Bitcoin wallet keystone devices destroyed stolen key (decrypt.co)
• Keystone Hardware Wallet on X: "Statement Regarding the Security Incident on Our Official Website and Customer Guidance" / X (x.com)
• Keystone to Destroy 18,835 Devices After Authentication Key Breach (forklog.com)
• Keystone to Destroy 18,835 Hardware Wallets After Attacker Steals Device Authentication Key (blockhead.co)
• Keystone Halts Web Orders, Will Junk 18,835 Wallets in Stock Over Stolen Authenticity Key - Unchained (unchainedcrypto.com)
• Keystone to destroy almost 19,000 wallets after device key leak (protos.com)
• Keystone Breach Widens as Attacker Grabs Its Device Authentication Key (tech.yahoo.com)