Keystone Wallet Breach Exposes Authentication Key and Buyer Data

Keystone, a hardware wallet maker, disclosed that hackers who breached its website stole an authentication key used to verify that its devices are genuine. The compromised key could allow attackers to manufacture counterfeit wallets that pass authenticity checks, potentially tricking users into installing malicious hardware that captures recovery phrases and other sensitive information.

According to Keystone, the attacker exploited a vulnerability in a third-party monitoring tool connected to the company’s website and escalated privileges. The company plans to destroy 18,835 devices in its inventory containing the compromised key and has suspended shipments of products using it. Production is expected to resume after Keystone begins manufacturing devices with a new authentication key.

Keystone said devices manufactured and delivered before Oct. 20 should remain trustworthy, but it could not guarantee the authenticity of devices shipped after that date. Affected buyers were urged to contact Keystone support for additional verification. The company also reported that its Shopify store generated 51,083 buyer records. Although 25,119 records were automatically removed under its 180-day retention policy, 25,964 records from 2024 through 2026 may have been stolen.

The incident follows other attacks on hardware wallet suppliers. Ledger recently asked resellers in Southeast Asia and Hong Kong to suspend sales amid reports of unauthorized implants on some devices. Coldcard maker Coinkite also warned earlier this year that a vulnerability had caused some devices to generate wallet seeds with less entropy than intended, contributing to losses estimated at millions of dollars.