Hardware wallet maker Keystone disclosed that attackers who breached its website last week stole a key used to verify device authenticity. The company initially characterized the incident as a customer data leak before revealing the broader scope of the compromise.
According to Keystone's statement, the stolen authentication key could enable attackers to manufacture fake wallets capable of passing the company's authenticity verification. Such counterfeit devices could be sold to customers unaware they were using non-genuine products, creating a risk of asset theft.
Scope of the Breach
The attacker gained access through a vulnerability in a third-party monitoring tool deployed on Keystone's website, allowing them to escalate privileges and obtain customer information alongside the authentication key.
Keystone will destroy 18,835 devices in inventory containing the compromised key and has suspended all shipments of devices using it. Shipments will resume once the company manufactures devices with a new authentication key.
The company said devices manufactured and delivered before October 20 remain safe, with their authenticity checks remaining trustworthy. However, Keystone cannot guarantee the integrity of devices delivered after that date and has urged affected customers to contact support for additional verification.
Customer Data Exposure
Keystone's Shopify store contained 51,083 buyer records. Of these, 25,119 had been deleted under the company's 180-day data retention policy. The remaining 25,964 records, dating from 2024 to 2026, may have been stolen after an automated deletion tool failed to operate reliably.
An additional 12,873 incomplete checkout records hosted by Shopify may have been accessed. Keystone has requested that Shopify delete personal information in checkout records retained beyond 30 days.
Pattern of Hardware Wallet Attacks
The Keystone breach is part of a broader trend of attacks targeting hardware wallet manufacturers in 2024. Ledger, Coldcard, Trezor, SafePal, and BitBox have all experienced security incidents ranging from supply chain tampering to data exposures and phishing campaigns.
