Keystone to destroy 18,835 devices after authentication key theft

Keystone disclosed Monday that an attacker stole a device-authentication key and 25,964 buyer records dating from 2024 to 2026.

The stolen key could let an attacker produce counterfeit wallets that pass Keystone's authenticity checks. “These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” the company said.

Keystone plans to destroy 18,835 devices in inventory that contain the compromised key. It has suspended production shipments of all devices using it. Those shipments will resume once Keystone starts producing devices with a new authentication key. The update widened an incident Keystone first described as a customer-information leak.

How did the attacker obtain the key?

Keystone said an attacker breached its website last week by exploiting a vulnerability in a third-party monitoring tool to escalate privileges. “This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices,” Keystone said.

The route connected the customer-data intrusion with the process used to validate finished hardware. A successful check now carries less weight because the key behind that check has been exposed.

What changed in the customer-data leak?

Shopify generated 51,083 buyer records for Keystone's website. Keystone had deleted 25,119 under its 180-day data-retention policy. The attacker took the remaining 25,964 records, dated from 2024 through 2026.

Keystone said its automated bulk-erasure tool did not operate reliably. Some erasure tasks failed, and the company did not detect or address those failures before personal information was retained beyond the permitted period.

Another 12,873 records came from Shopify checkout sessions tied to purchases that had not been completed. Shopify retained them for more than 30 days, and Keystone said it contacted the platform to request deletion. The update adds abandoned checkout records to the completed-buyer exposure.

What does the breach change for buyers?

Keystone draws the dividing line at Oct. 20. Devices manufactured and delivered before the Oct. 20 incident should be considered safe, and their authenticity checks remain trustworthy, the company said.

For devices delivered after that date, Keystone cannot guarantee authenticity. It asks affected customers to contact support for additional verification.

The stolen key shifts the risk beyond stolen customer details. A counterfeit device could pass the check meant to establish that it came from Keystone. Buyers need company verification rather than relying on the authenticity check alone.

Why does this matter beyond Keystone?

The latest breach belongs to a broader pattern of hardware-wallet security failures this year:

• Earlier this month, Ledger asked resellers across Southeast Asia and Hong Kong to suspend sales after reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases.
• In late July, Coldcard manufacturer Coinkite warned users after attackers exploited a bug that caused devices to generate wallet seeds with less entropy than intended. The issue resulted in the theft of millions of dollars in crypto.
• In August, Trezor disclosed a breach at a shipping partner. The affected-user count expanded to more than 80,000 in September.
• SafePal reported an August order-tracking vulnerability that exposed data belonging to nearly 40,000 customers.
• BitBox was targeted in a September phishing campaign involving a compromised third-party email provider.

The pattern reaches further back. A June 2020 breach at Ledger exposed more than 1 million email addresses, along with customer names, phone numbers and physical addresses. The leaked information fueled years of phishing attempts against affected users.

Taken together, these cases separate two exposure tracks: stolen customer records and weakened trust in the devices meant to protect crypto assets. Keystone now sits at both.

Keystone has not published a restart date for shipments tied to the compromised key. Those shipments will resume once the company begins making devices with a replacement authentication key, while customers who received devices after Oct. 20 will still need individual verification.