A security breach at hardware wallet manufacturer Keystone has escalated significantly, forcing the company to destroy 18,835 devices in inventory and suspend shipments after attackers obtained a critical device authentication key.
On October 26, 2026, Keystone disclosed that hackers accessed the WebAuth key used to verify whether its hardware wallets are genuine. The company traced the intrusion to a vulnerability in a third-party data monitoring tool that enabled attackers to escalate their access privileges. Keystone detected suspicious activity on October 20, disabled affected website functions, and initiated a forensic investigation.
The stolen authentication key poses a significant risk. An attacker possessing it could theoretically manufacture counterfeit devices capable of passing Keystone's authenticity checks, potentially exposing buyers to asset theft. Because the key is permanently embedded during manufacturing and cannot be rewritten or erased, Keystone determined that destroying all affected inventory was necessary. Newly manufactured wallets will receive replacement authentication keys.
Keystone has suspended shipments of existing website orders and switched to preorders until replacement production is ready.
Customer Data Exposure and System Failures
The investigation also revealed a serious failure in Keystone's customer data management. Of 51,083 Shopify buyer records examined, 25,964 retained personal information including names, shipping addresses, contact details, and purchase histories spanning 2024 through 2026. Keystone acknowledged that its automated deletion system had malfunctioned, allowing customer information to remain stored beyond its 180-day retention policy.
Investigators additionally identified 12,873 unpaid checkout records containing potentially sensitive customer information. Keystone has included those records in its response and initiated additional deletion requests. The company has shortened its retention period to 90 days and expects overdue buyer data deletion requests submitted on October 24 to be completed by November 3.
Security Assurances for Existing Users
Keystone stated that recovery phrases, private keys, wallet credentials, and payment information were not compromised in the breach. Devices delivered before October 20 remain safe to use if they pass authentication checks. Devices received afterward using the compromised key require additional verification through customer support, even if authentication succeeds.
Keystone has warned customers against fraudulent recall messages requesting device returns. The company has submitted regulatory reports in the EU, U.K., and other jurisdictions and plans to introduce breach lookup tools and conduct additional security audits.
