Keystone to destroy 18,835 hardware wallets after device authentication key theft
Author: Crypffalo Research · 00:53 27/10/2026
Keystone says hackers stole the WebAuth key used to verify genuine devices plus about 26,000 customer records. It will scrap 18,835 wallets and pause shipments; private keys and seed phrases were not exposed.
Hardware wallet maker Keystone on Oct 26 published the findings of its investigation into an Oct 20 breach of its website. Attackers obtained the "WebAuth" key the site uses to check whether a device is genuine.
The company will destroy 18,835 wallets in inventory that carry the old key and has paused shipments of unfulfilled orders. About 25,964 customer records were exposed, but Keystone says users' private keys and seed phrases were not affected.
Key takeaways
- Incident: Attackers accessed Keystone's website on Oct 20 through a flaw in a third-party data monitoring tool.
- Exposed: 25,964 customer records (names, contact details, addresses, 2024–2026 orders) plus 12,873 incomplete checkout records.
- WebAuth key: Stolen, potentially letting counterfeit devices pass genuineness checks.
- Response: 18,835 inventory devices to be destroyed, shipments paused, sales moved to preorder.
- Funds: No crypto theft reported; private keys and recovery phrases were not compromised.
What happened
According to Keystone's disclosure, as summarized by crypto.news and The Defiant, the attacker exploited a vulnerability in a third-party data monitoring tool to reach the official website. Keystone says it blocked the access and disabled sensitive site functions the same day.
It then patched the flaw and launched a forensic investigation. That review found the attacker took both customer data and the WebAuth key.
Keystone's Shopify store held 51,083 purchase records in total. Of those, 25,119 had already been erased before the attack, leaving 25,964 records exposed.
Why the authentication key matters
The WebAuth key plays no role in generating recovery phrases, deriving private keys or signing transactions. A wallet already in use cannot be drained simply because this key leaked.
The risk lies elsewhere: bad actors could build counterfeit devices that still pass the website's authenticity check. A fake wallet could come preloaded with a recovery phrase controlled by the attacker.
That is why Keystone is scrapping 18,835 units with the old key rather than selling them. Replacement devices will use a new key.
Keystone's guidance for users
- Devices delivered before Oct 20 remain safe if they pass authentication.
- Devices received after Oct 20 with the old key: contact support for extra verification before funding, even if the wallet passes the online check.
- Keystone is not asking anyone to return wallets. Any "recall" request should be treated as a scam.
- Affected customers will get individual emails, and a lookup page is planned.
Keystone has also cut its customer data retention period to 90 days. It filed deletion requests with Shopify on Oct 24, expects them to complete by Nov 3, and has reported the incident to regulators in the EU, UK and other jurisdictions.
Earlier, The Block reported that some users on X questioned why exposed data still existed, given Keystone's stated policy of deleting customer information after 180 days.
What it means for crypto markets
No funds were taken, so the incident is unlikely to move bitcoin, which is hovering near $80,000 ahead of the Fed meeting. The main impact is on trust in the hardware wallet supply chain and phishing risk for customers whose addresses leaked.
- Bull case: Detailed disclosure and destroying inventory limit the chance of counterfeit units reaching buyers, and could push the hardware wallet industry to tighten key management and data handling.
- Risk case: Leaked names, phone numbers and home addresses could fuel fake "wallet recall" emails and texts, or even physical threats against crypto holders.
It is the second Bitcoin wallet security story of the day, after Electrum patched a flaw that let malicious servers swap transactions.
What to watch next
- Keystone's device lookup page and individual customer notifications.
- When replacement devices with the new key start shipping.
- Shopify data deletion (expected by Nov 3) and the outcome of Keystone's security audit.
- The Fed decision on Oct 28 (US time) – see the economic calendar and real-time liquidations.
Frequently Asked Questions
Are funds on my Keystone wallet at risk?
Keystone says the leaked key has nothing to do with recovery phrases or private keys. Devices received before Oct 20 that pass authentication remain safe, according to the company.
What should I do if I received a device after Oct 20?
Contact Keystone's official support for extra verification before depositing funds. Never send your wallet to anyone claiming to run a recall.
Why is Keystone destroying 18,835 wallets?
Those units carry the old, compromised authentication key. Destroying them prevents fake and genuine devices from sharing the same verification key.
*This content is for information only and is not financial advice.*
Tags: Keystone, Hardware Wallet, Security, Data Breach
Related articles
- Binance targets Nov 1 withdrawal restart after finding more breach points in $6.3B hack
- Crypto stocks slide: Coinbase drops 12%, Strategy 11% as Binance hack weighs
- Binance sets aside $6.34 billion in corporate funds to cover hack losses
- Bitcoin Falls Below $77,000 as Binance Hack Triggers $1.5B in Liquidations
- Binance confirms $6.3 billion hack as analysts point to North Korea's Lazarus
- Binance Halts Withdrawals on Several Networks After Suspected Hack; CZ Expects Full Cover