Hardware wallet maker Keystone announced it will destroy 18,835 unsold devices and suspend shipments following a website breach that exposed customer information and a critical authentication key.
An attacker gained unauthorized access to Keystone's website on October 20 through a vulnerability in a third-party data monitoring tool, the company disclosed Monday. The breach exposed 25,964 buyer records spanning 2024 through 2026, containing names, contact details, shipping addresses, and order information. An additional 12,873 unpaid checkout records may have been affected.
The compromised authentication key is built into devices during production and cannot be modified. This key allows wallets to pass online authenticity checks, creating a risk that counterfeit devices could appear legitimate and endanger user funds.
Keystone stated the breach did not expose recovery phrases, private keys, or wallet credentials. However, some customer records should have been deleted under the company's 180-day retention policy, but an automated deletion tool failed without being detected.
The incident adds to recent security challenges in the hardware wallet sector. Ledger disclosed that attackers fitted devices sold through Southeast Asian resellers with hidden components designed to capture recovery phrases during setup. Coldcard separately identified a flaw in its seed-generation software that enabled attackers to reconstruct private keys and drain wallets remotely.
Keystone said devices delivered before October 20 remain safe if they pass authentication checks. Customers who received devices using the old key after that date should seek additional verification before use. The company advised users that moving funds is not necessary due to the breach alone and warned against fraudulent recall or asset migration messages.
To address the vulnerability, Keystone will replace the authentication key in new devices, transition website sales to preorders, and reduce customer data retention to 90 days.
