Keystone has expanded the scope of last week’s website intrusion, saying the attacker not only accessed parts of its customer database but also stole a cryptographic key used to authenticate the company’s hardware wallets. The development raises new concerns for users who rely on device authenticity checks to reduce the risk of tampered products.
In an update shared on Monday, Keystone warned that the stolen authentication key could enable counterfeit devices to pass its verification process. The company also disclosed the volume of buyer data it believes was exposed and outlined steps to destroy affected inventory.
Key takeaways
- Keystone says the attacker stole an authentication key that verifies whether its hardware wallets are genuine, potentially enabling counterfeit devices.
- The firm plans to destroy 18,835 devices in its inventory that contain the compromised key and has paused shipments using the old authentication material.
- Keystone estimates 25,964 buyer records from 2024–2026 may have been stolen after an automated deletion tool failed to complete some erasure tasks.
- The company states devices manufactured and delivered before the Oct. 20 incident should remain trustworthy under its authenticity checks.
- Multiple hardware wallet manufacturers have reported security incidents this year, often involving third-party services.
An authentication key, not just customer data
Keystone initially described the incident as a customer data leak. According to its Monday statement on X, the attacker also obtained a key used to verify the authenticity of Keystone devices. In the same update, the company said this creates a realistic path for fraudsters to produce counterfeit wallets that can still satisfy Keystone’s authentication checks.
Keystone warned that such counterfeit devices could be sold or shipped to customers, who may not recognize them as fake—raising the possibility of asset theft if users import or transact using compromised hardware.
To understand why this matters, it’s worth noting the role of authenticity verification in the hardware-wallet model. Unlike purely software-based wallets, hardware wallets aim to reduce exposure to malicious code by relying on trusted device identity and secure initialization. If that identity layer is undermined—whether through supply-chain manipulation or counterfeit hardware—users may lose confidence in the “verification” guarantees they expect from the manufacturer.
Inventory destruction and shipment pause
Keystone said the attacker reached the authentication key after exploiting a vulnerability in a third-party monitoring tool used by its website. The company then moved to contain the risk through changes to what it ships.
Specifically, Keystone said it will destroy 18,835 devices in inventory that contain the compromised key. It also suspended production shipments of devices using the old authentication key.
Keystone stated that shipments will resume once it begins manufacturing new devices with a replacement authentication key. The company added that devices manufactured and delivered before the Oct. 20 incident should be considered safe, and that its authenticity checks remain reliable for that pre-incident population.
At the same time, Keystone cautioned that it cannot guarantee authenticity for devices delivered after Oct. 20. It urged customers with potentially affected units to contact support for additional verification.
What Keystone says about the customer data exposure
Beyond the authentication-key compromise, Keystone also quantified the suspected reach of the customer data incident. The company said its Shopify store generated 51,083 buyer records.
Keystone reported that 25,119 of those records were deleted under its 180-day data retention policy. That left 25,964 remaining entries dated from 2024 to 2026—records Keystone said may have been stolen by the attacker.
The company attributed the retention of older records to a malfunction in its automated bulk erasure tool. Keystone said the tool did not reliably complete all deletion tasks and that the company did not detect and correct those failures in time, resulting in some personal information being held longer than permitted.
Keystone also said the attacker may have accessed 12,873 customer checkout records stored by Shopify from purchases that were not completed. The firm stated it contacted Shopify to request deletion of personal information in checkout records retained for more than 30 days.
The incident follows a pattern that has become familiar in the hardware-wallet space: breaches tied to online storefronts, databases, and third-party infrastructure rather than direct compromise of the wallet firmware itself. While this does not automatically imply device-level tampering, it does create incentives for phishing and social engineering against users—especially when contact and address details are exposed.
Hardware wallet security incidents continue to pile up
Keystone’s update is the latest in a broader series of issues targeting hardware wallet manufacturers this year. Earlier reporting highlighted that Ledger asked resellers across parts of Southeast Asia and Hong Kong to pause sales after reports that some devices contained unauthorized implants capable of capturing recovery phrases (as covered by Cointelegraph: here).
Cointelegraph also previously noted that Coldcard maker Coinkite issued a warning in late July after attackers exploited a bug that caused devices to generate wallet seeds with less entropy than intended, leading to theft of millions of dollars in crypto (Cointelegraph: here).
Keystone’s own disclosure of a compromised authentication key suggests a deeper threat model than standard data leaks alone. Instead of limiting impact to scams and phishing, the stolen verification key introduces a potential counterfeit-device vector—something users may not be able to detect through routine checks.
The wider industry has also seen retailer- and logistics-related breaches. For example, Cointelegraph reported that Trezor disclosed a breach at its shipping partner and that the number of affected users expanded over time (here, and here). SafePal also disclosed an order-tracking vulnerability impacting nearly 40,000 customers (Cointelegraph: here), while BitBox faced a phishing campaign linked to a compromised third-party email provider (Cointelegraph: here).
Historically, similar incidents have had long tail effects. A June 2020 breach at Ledger exposed more than 1 million email addresses along with personal details, and Cointelegraph previously reported that the leaked information was later used to fuel phishing attempts. Keystone’s latest update is likely to intensify user attention on how they verify devices—particularly when authenticity systems themselves are involved.
What users should watch next
For Keystone customers, the most practical next step is verification guidance from the company for units tied to the Oct. 20 timeframe. More broadly, the industry will likely face increased scrutiny on how wallet makers secure authentication keys and third-party tooling—areas that can turn “website incidents” into risks that affect device trust, not just customer privacy.
Be the first to comment