Keystone's Breach Just Got Worse
The hardware wallet maker lost its device authentication key, is scrapping 18,835 units, and broke its own data-deletion promise.
By The crypto-money Desk
A breach at Keystone, the hardware wallet maker, has expanded well beyond a standard data leak. On Oct. 26th, the company confirmed that the attacker who infiltrated its Shopify-based store on Oct. 20th also walked off with the WebAuth key — the credential baked into every device at the factory to prove it is genuine. [1]
That key cannot be changed after manufacture. It plays no role in generating seeds or signing transactions, but in the wrong hands it could let a counterfeit device pass Keystone's own authenticity check. [1] The company is destroying all 18,835 units in its current inventory that carry the compromised key. [1]
The attacker entered through a flaw in an unnamed third-party monitoring tool connected to Keystone's store. That single crack exposed 25,964 buyer records covering 2024 to 2026 — names, contact details, shipping addresses, and order histories. [1] Keystone is also treating 12,873 unpaid checkout records as potentially compromised, as a precaution. Seeds, private keys, bank payment data, and government IDs are reported safe; Amazon sales were not affected. [1]
[1] The company confirmed the gap — some tasks in its automated erasure tool failed, and the company didn't catch them in time. [1] Keystone has since cut its retention window to 90 days.
The failure compounds the breach itself. A data-retention policy only earns trust if it actually runs — and silent failures in background jobs are precisely the kind of operational debt that security teams can overlook until it becomes someone else's problem.
For owners holding devices delivered before Oct. 20th that pass the authentication check, Keystone says those units are genuine. [1] For any unit received after that date using the old key, the company says it "cannot completely rule out the possibility that it is counterfeit," even if the check passes. [1] Those owners should contact Keystone support for additional verification before using the wallet.
Keystone also warns that it will not ask anyone to return a device — any "recall" message is a scam, as are offers to migrate assets or verify a wallet remotely. [1] Expect phishing attempts targeting the 25,964 exposed customers in the coming weeks; their names and addresses are now in attacker hands.
Keystone is not alone in a bad year for hardware wallet security. Trezor reported that a breach at its shipping partner ShipMonk exposed 80,689 customers, including people whose data ShipMonk had assured it was deleted. [1] Foundation traced phishing emails sent from its own domains to compromised Cloudflare API keys. [1]
The pattern across every incident is the same: the secure chip holds, and the perimeter around it crumbles. Supply chains, logistics partners, third-party monitoring tools, resellers — each is a seam where trust gets stitched in and attackers probe for gaps.
The practical guidance from all three incidents converges on two points: buy directly from the manufacturer, and never enter a seed phrase into a device you did not order yourself. [1] The hardware inside these wallets is often the last thing that fails.
cannot completely rule out the possibility that it is counterfeitKeystone