Keystone, a cryptocurrency hardware wallet manufacturer, has disclosed further details of a security breach involving customer purchase records and a compromised device-authentication key.
The incident affected 25,964 purchase records and 12,873 incomplete checkout records, while raising concerns that counterfeit wallets could pass the company’s authenticity checks. Keystone says recovery phrases, private keys and transaction signing were not compromised.
Keystone Breach Exposes Nearly 39,000 E-Commerce Records
According to Keystone’s investigation, the breach exposed 25,964 purchase records and 12,873 incomplete checkout records. These figures represent records, not necessarily unique individuals, and the company has not established that every record corresponds to a separate customer. The incident highlights how an online store can expose sensitive information even when the wallet technology itself is designed to keep private keys offline.
Keystone’s earlier security statement said attackers obtained customer shipping information, including names, contact details, addresses and order details. The company said payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed. It detected unauthorized website access on October 20 and confirmed the data theft on October 23 after reviewing API activity with Shopify.
Also Read: Keystone Hardware Wallet Confirms Customer Data Exposure After Website Breach
Compromised WebAuthn Key Raises Counterfeit Wallet Risks
The more serious development is the reported theft of a WebAuthn device-authentication key used in Keystone’s verification process. According to the company’s latest findings, attackers could potentially use the compromised key to make counterfeit hardware wallets pass official authenticity checks. That creates a supply-chain security concern beyond the exposure of customer information.
Keystone’s device verification system is designed to help users confirm that a device and its firmware are genuine and have not been tampered with. The company says it will destroy 18,835 unsold devices associated with the old key and move new production to a replacement key. It is also pausing unshipped orders while it addresses the issue, although the full scope of the verification risk remains subject to further investigation.
Customer Data Exposure Raises Risks Beyond Phishing
Exposed shipping addresses and purchase histories can help criminals identify people who own cryptocurrency hardware wallets. That information could support targeted phishing attempts, impersonation scams or attempts to pressure victims into revealing sensitive wallet information. Keystone has warned customers about fake calls, messages and offers of refunds or replacement devices.
The wider risk is not merely theoretical: Cointelegraph reported that blockchain security firm CertiK recorded 52 verified physical attacks against crypto holders worldwide in the first half of 2026, up 33% from 39 in the same period a year earlier.
That figure does not mean Keystone customers have been targeted physically, but it illustrates why linking a person’s identity and address to cryptocurrency ownership can be dangerous. Customers should treat unexpected communications about the breach with caution.
Keystone Faces Questions Over Security and Data Retention
The incident also raises questions about how long customer information remained accessible. The Block reported that Keystone had previously promoted a 180-day shipping-data deletion policy, while some customers said they received breach notifications relating to older purchases. The company has not yet publicly resolved those reports in a detailed forensic account.
Keystone says it has blocked unauthorized access, fixed the website vulnerability and begun notifying affected customers. Its planned response includes replacing the compromised verification key, destroying affected unsold devices and publishing a more detailed report.
Until that report clarifies the attack method and the full scope of the incident, customers should verify devices through official channels and never enter a recovery phrase into an unexpected or untrusted device.
Also Read: Bitget Withdrawals to Resume After $387.5 Million Security Breach
Be the first to comment