Hardware wallet maker Keystone has confirmed that an attacker who broke into its official website stole the key its devices use to prove they are genuine, along with personal data tied to 25,964 buyer records. In a statement published on October 26, 2026, the company said it will destroy 18,835 unsold wallets that carry the compromised key and move all future production to a new one.
Keystone said the stolen key could let someone build counterfeit wallets that pass its official authenticity check. The company stressed that recovery phrases, private keys and other wallet credentials were not involved, and it has not reported any counterfeit devices or asset thefts linked to the incident so far.
How the attacker reached Keystone’s device key
According to Keystone, its security monitoring detected unusual access to the website on October 20, 2026. The company said it disabled sensitive website functions, blocked the access points and fixed the vulnerability that same day.
The investigation found that the attacker exploited a vulnerability in a third-party data monitoring tool running on the website to escalate privileges. Keystone has not named the tool or the vendor. That access gave the attacker some customer information and the WebAuth key behind the device check at keyst.one/authentication.
Keystone first disclosed the incident on October 24 as a customer data leak, saying it had confirmed on October 23, after reviewing API activity with Shopify, that a third party obtained shipping information. The October 26 statement widened the scope to include the authentication key.
Why a stolen WebAuth key matters for counterfeit wallets
Keystone said the WebAuth key is written into every device during manufacturing and cannot be erased or rewritten. It plays no role in generating recovery phrases, deriving private keys or signing transactions.
That is exactly what makes the theft serious. In the company’s words, an attacker holding the key “could use it to produce counterfeit devices that pass authentication checks,” which “could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.”
Keystone has not explained its WebAuth design, but a key reachable through website infrastructure being enough to fake a pass suggests the check relied on a shared secret rather than a scheme where the server holds only a public key.
Keystone pulls 18,835 wallets and pauses shipping
Keystone confirmed the following changes to manufacturing and fulfillment:
- Production stopped using the old key immediately, and all newly manufactured devices will use a new authentication key.
- The 18,835 devices in existing inventory that carry the old key will be destroyed and will not be sold or shipped.
- Shipping of all unshipped orders from the official website is suspended, and sales have moved to a preorder model.
In a follow-up reply on X, Keystone said devices with the new key are expected to ship within 4 to 6 weeks.
Customer data and a failed deletion tool
The attacker reached 51,083 buyer records from Keystone’s Shopify store. Personal data had already been erased from 25,119 of them, but the remaining 25,964 records still held names, contact details, shipping addresses and order information covering 2024 to 2026. Amazon and other sales channels were not affected.
The company also found 12,873 checkout records where payment was never completed. Keystone admitted that an automated tool it built to erase buyer records after 180 days failed silently, leaving data in place longer than promised. It has cut retention to 90 days and asked Shopify on October 24 to erase overdue data, with completion expected on November 3, 2026. Keystone said it has filed regulatory reports in the EU, the UK and other jurisdictions.
What Keystone owners should do now
Keystone’s guidance depends on when a device arrived, using October 20, 2026 as the cutoff:
- Delivered before October 20, 2026: Keystone said authentication for these devices is unaffected. If a device passes the check, it can be treated as genuine and used normally, and owners do not need to move funds because of this incident.
- Received after October 20, 2026 with the old key: Passing the authentication check is no longer enough. Owners should contact Keystone support through the authentication page or at
support@keyst.onefor additional verification and only use the device once it is confirmed. - No recall: Keystone said it will never ask customers to return a device. Anyone requesting a device be shipped back under a “recall” should be treated as a scammer.
With names and home addresses exposed, customers should expect targeted phishing, calls and mail offering “asset migration,” “wallet verification” or replacement devices. Never enter a recovery phrase into a website, a form or a device you did not order.
A growing supply-chain problem for hardware wallets
Hardware wallet security extends well beyond the secure chip. Attackers have already used fake companion software, as seen when a fake Ledger Live app drained $9.5 million from 50 victims, and tampered physical devices, as covered in our report on spy chips in hardware wallets used to steal recovery phrases. Customer lists are a recurring weak point too, as the Trezor ShipMonk breach showed.
Open questions remain, including how reseller buyers should apply the October 20 cutoff and how owners can tell which key their unit carries. Keystone said more details on device verification will be shared in the coming days.
