Keystone to Scrap 18,835 Wallets After Attacker Steals Device Key
Keystone will destroy 18,835 inventory wallets after the attacker behind its website breach stole the WebAuth key used to verify devices. Old-key units received after Oct. 20 need extra checks, even if they pass online verification.
Keystone will scrap 18,835 hardware wallets in its inventory after the attacker behind its website breach also stole the WebAuth key the company uses to confirm devices are genuine. The hardware wallet maker disclosed the theft in an update on Monday, Oct. 26.
The company had already disclosed the breach it detected on Oct. 20, as our earlier coverage reported. The new disclosure moves the damage beyond customer data to the trust model behind the hardware itself.
"the attacker also obtained the WebAuth key we use to verify whether a device is genuine."
Keystone
The key is written into each device at the factory and cannot be changed afterward. Keystone says it plays no role in generating seeds or signing transactions. In the wrong hands, though, it could let counterfeit devices pass Keystone's authenticity check. New units will get a fresh key, and website orders are on hold in favor of preorders until that batch is ready.
What owners should do
Keystone says a device delivered before Oct. 20 that passes authentication is genuine. Units with the old key received after that date are a different matter. For those, the company says it "cannot completely rule out the possibility that it is counterfeit," even if the online check passes. Owners in that position should contact support for additional verification.
Keystone also says it will not ask anyone to return a device. Any recall request, asset migration offer or wallet verification offer should be treated as a scam.
Data exposure and retention failure
The attacker got in through a flaw in an unnamed third-party monitoring tool on Keystone's Shopify-based site. That exposed 25,964 buyer records from 2024 to 2026, covering names, contact information, addresses and order details. Keystone is also counting 12,873 unpaid checkout records as a precaution. It says seeds, private keys, bank payment information and government IDs are safe, and that its Amazon sales were unaffected.
Keystone had advertised that shipping data is wiped within 180 days. It confirmed that some tasks in its automated erasure tool failed without being caught, and it is cutting retention to 90 days. The company states that another 25,000 records had already been permanently erased under its retention policy.
Keystone first confirmed the suspected breach of shipping information on X on Saturday, roughly 18 hours after a customer reported a social engineering call that used Keystone order information.
Why it matters
The episode shows how supply chain trust can fail without any compromise of the secure chip. Attackers targeting hardware wallet makers are largely leaving the secure chip alone and going after everything around it. Here, that meant order data and a factory credential rather than seed material.
By Keystone's account, the stolen key cannot generate seeds or sign transactions. The practical exposure falls on buyers who received old-key units after Oct. 20, for whom a passing authenticity check is no longer conclusive, and on customers whose order details could fuel further social engineering.
