Keystone Will Destroy 18,835 Hardware Wallets After Factory Key Theft

Hardware wallet maker Keystone will destroy 18,835 unsold devices and has suspended all shipments after an attacker obtained the permanent factory key used to verify that its wallets are genuine. The breach, detected October 20, also exposed buyer records from the company's Shopify store covering 2024 to 2026.

The stolen asset is what Keystone calls a WebAuth key: a secret code written into each device at the factory so a page on the company's website can confirm the hardware is authentic. The key cannot be erased or rewritten. That permanence cuts both ways. It makes the verification robust, but once compromised it cannot be rotated in the field, which is why the entire inventory carrying it is being destroyed rather than sold.

The operational risk for buyers is precise: a counterfeit device that looks new and passes Keystone's own authentication check. "If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks," Keystone said in its statement. "These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft." A criminal could sell such a device to a user who then loads real funds onto it.

What does the breach change for buyers?

Three practical points from the company's disclosures:

• Recovery phrases and private keys were not involved in the breach.
• Devices delivered before October 20 are unaffected and remain genuine.
• No one from Keystone will request a device return. "Anyone contacting you under the pretext of a 'recall' and asking you to ship your device to them should be treated as a scammer," the company warned, flagging offers of "asset migration," "wallet verification" or "investigation assistance" as fraud vectors.

Keystone first disclosed on Saturday, October 24's timeline notwithstanding, that a third party had obtained customer shipping information. Monday's statement added the stolen key and the record count. The company has not said who is responsible or when the intrusion began.

The data exposure is narrower than first appearances suggest but larger than policy allowed. Of 51,083 buyer records involved from the Shopify storefront, 25,119 had already been erased under the company's deletion process. That leaves 25,964 records from 2024 to 2026 containing names, contact details, shipping addresses and order information. Purchases made through Amazon and other channels were not affected.

Some of that data should have been gone long ago. Keystone's policy was to erase buyer records after 180 days, but the automated bulk-deletion tool built for the task failed silently. "Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period," the company said. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure."

A sector-wide weak point

Customer lists remain a recurring failure mode for hardware wallet vendors. Ledger's 2020 leak ultimately reached roughly 292,000 customers, some of whom later received phishing emails and feared home invasion. Trezor and SafePal each disclosed customer-data breaches in August, affecting 13,689 and approximately 39,798 customers respectively. The stakes are physical: Chainalysis counted 46 violent crypto-related attacks in the first half of 2026, with more than $30 million stolen, the pattern known as wrench attacks in which criminals coerce owners into surrendering funds.

Remediation timeline

Keystone has moved on several fronts. It cut its data retention window from 180 days to 90, and on October 24 asked Shopify to erase all overdue buyer data, a process carrying a 10-day waiting period that the company expects to complete on November 3. Website sales will switch to preorders until production of devices carrying a new factory key finishes. Reports have been submitted to authorities in the EU, the UK and other jurisdictions.

For practitioners, the immediate question is supply-chain assurance: any Keystone device offered for sale through unofficial channels in the coming weeks carries elevated counterfeit risk until new-key inventory reaches the market.