Hardware wallet manufacturer Keystone has disclosed that attackers who breached its website last week stole a key used to verify the authenticity of its devices, significantly expanding the scope of what was initially reported as a customer data leak.
According to Keystone's statement, the stolen authentication key could allow attackers to produce counterfeit wallets capable of passing the company's authenticity verification checks. These fraudulent devices could potentially be sold to customers who believe they are purchasing genuine products, creating risk of asset theft.
Device Destruction and Production Halt
In response, Keystone said it will destroy 18,835 devices in its inventory that contain the compromised authentication key and has suspended production shipments of all devices using it. The company stated that shipments will resume once it begins manufacturing devices with a new authentication key.
Keystone confirmed that devices manufactured and delivered before October 20 should be considered safe, with their authenticity checks remaining trustworthy. However, the company cannot guarantee the authenticity of devices delivered after that date and is urging affected customers to contact its support team for additional verification.
Customer Data Exposure
Keystone also disclosed the extent of the customer data breach. The company's Shopify store had generated 51,083 buyer records, of which 25,119 had been deleted according to its 180-day data retention policy. The remaining 25,964 records dating from 2024 to 2026 were stolen by the attacker.
Keystone attributed the retention of records beyond the permitted period to failures in its automated data deletion tool. The company stated that erasure tasks failed and these failures were not detected and addressed in time. Additionally, attackers stole 12,873 customer checkout records retained by Shopify from incomplete purchases.
Broader Industry Pattern
The Keystone breach adds to a series of attacks targeting hardware wallet manufacturers in recent months. In October, Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales after reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases. In late July, Coldcard manufacturer Coinkite warned users after attackers exploited a bug that caused devices to generate wallet seeds with reduced entropy, resulting in millions of dollars in cryptocurrency theft.
Other manufacturers have also experienced breaches involving customer information this year. Trezor disclosed a breach at its shipping partner in August that exposed customer information, with affected users expanding to more than 80,000 by September. SafePal reported an order-tracking vulnerability in August affecting nearly 40,000 customers, while BitBox was targeted in a September phishing campaign involving a compromised third-party email provider.
