Keystone Hardware Wallet announced it will destroy nearly 19,000 unshipped wallets following a security breach that exposed a critical device verification key.
The company detected unauthorized access to its official website on October 20 and confirmed on October 23 that a third party obtained customer shipping information including names, contact details, shipping addresses, and order details. The breach affected approximately 26,000 records from Shopify purchases, with an additional 13,000 incomplete purchase records also compromised.
Keystone stated that payment information and wallet keys were not involved in the breach. However, the company warned customers against scammers impersonating Keystone staff and offering refunds or replacement devices.
The most serious aspect of the breach involved the attacker obtaining the WebAuth key used to verify whether a device is genuine. In response, Keystone suspended shipping and will destroy the affected inventory. Newly built wallets will use a replacement verification key.
Keystone acknowledged that its automated data deletion tool "did not operate reliably," resulting in personal information being retained beyond the permitted retention period. The company had previously stated that shipping data would be permanently deleted 180 days after purchase.
Related Incidents
Foundation Passport, another hardware wallet manufacturer, separately reported phishing emails sent from its official domain following compromised API keys on Cloudflare. Foundation confirmed that over 20,000 phishing attempts were delivered across its systems and stated it was determining how many users had personal data exposed.
Foundation previously assured users that customer data is automatically deleted after 60 days. The company later clarified that while its former provider WooCommerce purged order data, older database copies retained personal information during past migrations. Orders placed via Shopify may also have been exposed.
