Keystone, a cryptocurrency hardware wallet manufacturer, announced plans to destroy 18,835 unsold devices after discovering that attackers obtained an authentication key used to verify whether its wallets are genuine. The decision follows an October 20, 2026 security breach involving Keystone's online store, initially disclosed as an incident affecting customer names, contact information, shipping addresses and purchase details. In an expanded investigation update on October 26, the company confirmed that the attackers also accessed its WebAuth device-authentication key. The compromised credential could potentially allow counterfeit hardware wallets to pass Keystone's official authenticity verification process, creating risks for customers purchasing devices through unauthorized channels. This incident illustrates two distinct risks facing cryptocurrency hardware wallet manufacturers: exposure of personal information and compromise of the infrastructure used to authenticate physical devices.
Stolen Authentication Key Forces Inventory Destruction
According to Keystone, the attackers exploited a vulnerability in a third-party data-monitoring tool connected to its website, allowing them to escalate privileges and access sensitive information. Among the exposed assets was the WebAuth key embedded in hardware wallets during manufacturing.
The credential is used to authenticate devices through Keystone's official verification website. Because the key cannot be erased or rewritten after manufacturing, devices containing it cannot be updated to use a replacement credential.
Keystone plans to destroy all 18,835 affected devices currently held in inventory rather than distribute products whose authenticity could become difficult to establish. Future production will use a newly generated authentication key.
The company explained that the compromised credential does not generate recovery phrases, derive private keys or authorize cryptocurrency transactions. However, attackers possessing the key could potentially manufacture counterfeit devices that appear legitimate during authentication.
Such devices could expose customers to asset theft if malicious hardware were substituted during distribution. Keystone said wallets received and authenticated before October 20 remain safe to use. Customers who received devices containing the older key after that date have been advised to contact official support for additional verification.
The company emphasized that cryptocurrency recovery phrases, private keys, passwords and payment information were not compromised. Keystone has suspended shipments of unfulfilled website orders and moved to a preorder model while preparing replacement devices.
Nearly 39,000 Purchase and Checkout Records Exposed
The expanded investigation also established the scale of the customer-information breach. Keystone identified 51,083 historical buyer records in its Shopify-powered store, covering purchases between 2024 and 2026.
Personal information associated with 25,119 records had already been erased or anonymized before the intrusion. However, another 25,964 purchase records still contained identifiable customer information. Investigators also discovered 12,873 incomplete checkout records containing names, contact details and shipping information.
Together, the findings identify 38,837 potentially exposed purchase and checkout records, although this does not necessarily represent the same number of unique individuals. Keystone acknowledged that its automated data-deletion system had failed to consistently enforce its advertised 180-day retention policy.
Some deletion requests failed without being detected, leaving information accessible longer than intended. The company has shortened its customer-data retention period to 90 days and submitted deletion requests for overdue records.
Under Shopify's processing timetable, those requests were expected to be completed by November 3. Keystone plans to notify affected customers individually and introduce a service allowing users to check whether their information was exposed.
The company said regulatory and law-enforcement notifications had been submitted in relevant jurisdictions, including the European Union and United Kingdom.
FAQ
What did Keystone announce on October 26 regarding the security breach?
Keystone announced on October 26 that it will destroy 18,835 unsold hardware wallets after discovering that attackers obtained its WebAuth device-authentication key during an October 20, 2026 security breach. The company also confirmed that 38,837 purchase and checkout records containing customer information were potentially exposed.
Why is Keystone destroying nearly 19,000 hardware wallets?
Keystone is destroying the devices because the compromised WebAuth authentication key cannot be erased or rewritten after manufacturing. Attackers possessing this key could potentially manufacture counterfeit devices that appear legitimate during Keystone's official authenticity verification process, creating risks for customers.
What customer information was compromised in the Keystone breach?
The breach exposed 38,837 purchase and checkout records containing customer names, contact information, shipping addresses and purchase details. Keystone emphasized that cryptocurrency recovery phrases, private keys, passwords and payment information were not compromised.
