Keystone to Destroy 18,835 Devices After Authentication Key Leak

Hardware wallet manufacturer Keystone will destroy 18,835 unsold devices and suspend order shipments following a security incident on the official website. An attacker gained access to customer data and the WebAuth key, which is used for device authentication.

The attack occurred on October 20, 2026, through a vulnerability in a third-party data monitoring tool: the attacker escalated privileges and accessed information and the key. The leak affected 25,964 customer records who placed orders through Shopify on the official website from 2024 to 2026, including names, contact details, shipping addresses, and order information, as well as 12,873 records of incomplete checkouts. Purchases through Amazon and other channels were not affected.

The WebAuth key was recorded in the devices during manufacturing and cannot be removed or replaced. Its compromise theoretically allows for the creation of counterfeit devices that will pass authentication: customers may mistake them for genuine and put their crypto assets at risk. The company emphasized that the key is not involved in generating seed phrases, obtaining private keys, or signing transactions.

Keystone acknowledged that some personal data was stored longer than the established period due to a failure in the automated record deletion tool: the company did not detect the failure. Requests to delete expired data were sent to Shopify on October 24, with completion expected by November 3. The storage policy will be reduced from 180 to 90 days.

What customers should do

Keystone stated that the incident did not affect seed phrases, private keys, other wallet credentials, banking payment information, and government document numbers, so transferring assets solely due to the leak is unnecessary. Devices delivered before October 20 are safe if they pass authentication; customers who received a device with the old key after this date are advised to contact support for additional verification. The company warned about scammers who may offer "asset migration" or demand the return of the device.

Keystone has suspended order shipments and will switch to pre-orders until it starts releasing devices with a new key. New wallets will use a new verification key.

Previously, a similar incident was disclosed by Foundation: attackers sent phishing emails from its official domains. The company reported more than 23,000 phishing attempts and discovered old copies of the database that bypassed the 60-day deletion process – about 5,600 email addresses and 5,200 phone numbers.