Keystone to Destroy 18,835 Hardware Wallets After Authentication Key Theft

Hardware wallet maker Keystone will destroy 18,835 devices after a hacker stole the key used to check whether its wallets are genuine. The company has also paused shipments of outstanding website orders and will switch to preorders until new devices are ready.

The incident also exposed personal information in 25,964 customer records, including names, contact details, shipping addresses and order information.

Keystone said the breach did not expose users' bitcoin, recovery phrases or private keys. However, the stolen authentication key could allow criminals to make fake hardware wallets that pass the company's own security checks.

Keystone detected unauthorized access to its website on October 20, 2026. The company said the attacker exploited a vulnerability in a third-party monitoring tool used by the website to gain access to customer data and the device authentication key.

The key, known as the WebAuth key, helps users check whether a Keystone wallet is genuine. During verification, the device and Keystone's website exchange information to confirm that the device has the correct firmware.

The problem is that the attacker obtained a copy of that key. This could allow someone to make a counterfeit device that passes the same check.

For Bitcoin users, this creates a substantial risk because a fake hardware wallet could be designed to steal a recovery phrase or private keys. If criminals managed to sell such a device to an unsuspecting buyer, they could potentially gain control of the buyer's funds.

The authentication key itself does not control bitcoin funds. It is separate from the keys used to access a wallet and sign transactions.

Keystone said the key is permanently written into each device during manufacturing and cannot be erased or replaced. As a result, the company cannot simply update the affected wallets.

“Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit,” Keystone said.

Instead, it will destroy all 18,835 unsold devices containing the old key. Newly manufactured devices will use a replacement key, and shipments of outstanding orders from its official website will remain paused until new devices are available.

The company has not reported any confirmed cases of counterfeit devices or stolen bitcoin linked to the breach.

The investigation uncovered a separate problem involving customer data.

Keystone found that 51,083 buyer records had been stored through Shopify, the platform that runs its official online store. Of these, 25,119 had already been stripped of personally identifiable information before the breach. Another 25,964 still contained personal information from purchases made between 2024 and 2026.

The exposed information included customers' names, contact details, shipping addresses and order details. Purchases made through Amazon and other sales channels were not affected.

Keystone also identified 12,873 checkout records from customers who started but never completed a purchase. These records could contain names, contact details and shipping information.

The company said its system for automatically deleting old customer records had not worked reliably. Its previous policy required personal information to be deleted after 180 days, but some records remained stored beyond that limit.

“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone said.

The company has reduced its data retention period from 180 days to 90 days. It requested the deletion of overdue customer data from Shopify on October 24, with completion expected on November 3, 2026.

Keystone said payment card details, bank information and government-issued identification numbers were not exposed.

Keystone's advice depends on when a customer received their device. For devices received before October 20, owners can continue using their wallets normally if the devices pass authentication, according to the company.

For devices received after October 20 with the old key however, the company advises owners should contact Keystone support at [email protected] and avoid using the device until the company confirms it is genuine. Passing the normal authentication check is not enough to rule out counterfeiting.

As for the customers waiting for orders, Keystone says shipments from Keystone's official website have been paused while the company prepares devices with the new key.

Keystone said users do not need to move their bitcoin or other digital assets simply because of this incident. The company reported no compromise of recovery phrases or private keys.

However, owners should remain alert to phishing attempts. Scammers may use the news to send fake messages offering wallet replacements, refunds, security checks or help moving funds.

Keystone said it will never ask customers to return their devices. Any request to send a wallet back under the pretext of a recall should be treated as a scam.

The Keystone incident follows a series of similar customer data breaches involving other hardware wallet manufacturers. In a similar case, Foundation disclosed that attackers had stolen customer data and shipping information from its WooCommerce store, subsequently sending out 23,000 phishing emails.

Bitcoin hardware wallet manufacturers have faced a growing number of security incidents in recent months, ranging from data breaches and theft to device tampering. Companies affected include Coldcard, Ledger, Trezor, and Foundation.