BTC $80,254 
ETH $2,326 
MGLOEURO $111,813 
USDT $0.9990 
BNB $741.39 
XRP $1.29 
USDC $0.9995 
SOL $100.60 
TRX $0.3312 
FIGR_HELOC $1.03 Hacks & Security · Explained
Keystone to destroy 18,835 wallets after breach exposes authentication key
Keystone says a stolen WebAuth key could let counterfeit devices pass authenticity checks, prompting it to scrap unsold inventory and pause shipments.
Key takeaways
- Key stolen. The WebAuth key used to verify Keystone devices was taken alongside customer records in a breach detected on 20 October 2026.
- Inventory scrapped. Keystone is destroying 18,835 unsold devices carrying the exposed key, which is written in during manufacturing and cannot be erased.
- Counterfeit risk. A holder of the key could build fake wallets that pass authenticity checks, potentially leading to theft of assets.
What happened
Keystone has confirmed that hackers who breached its website also made off with a key used to verify that its hardware wallets are genuine, widening an incident the company initially described as a customer-data exposure. In accounts published by Crypto Daily and The Daily Hodl, the manufacturer said it spotted the intrusion on 20 October 2026, after an attacker exploited a flaw in a third-party data monitoring tool used on its website to escalate privileges.
The intruder reached both customer records and the WebAuth key that underpins device authentication. According to the reports, 25,964 buyer records were exposed, containing names, contact details, shipping addresses and order information from 2024 through 2026, along with 12,873 unpaid checkout records. Keystone said recovery phrases, private keys and payment details were not among the data taken.
In response, Keystone has stopped using the compromised key in production and is destroying 18,835 unsold devices in its inventory that carry it. Shipments of unshipped orders have been suspended and the company has moved to a preorder model until hardware built with a new key is available. It has also cut data retention from 180 days to 90, filed erasure requests with Shopify and notified regulators in the EU, the UK and other jurisdictions. Devices shipped before 20 October 2026 remain valid provided they pass authentication, the company said.
Why it matters
The concern goes beyond leaked addresses. Keystone said the key is written into devices during manufacturing and cannot be erased or rewritten, making it the foundation of its authenticity checks. An attacker holding it could build counterfeit units that pass verification and sell them to buyers who believe they hold genuine hardware, potentially leading to theft of assets. Hardware wallets keep private keys away from the internet, but that guarantee rests on the device itself being trustworthy; a modified or fake unit could capture a recovery phrase during setup. Keystone apologised for the incident.
What the data shows
A Blockaid review of 60 major onchain exploits between January and August 2026 found attackers controlled about $1.18 billion in stolen assets. The median time before funds were moved was 17 minutes; in 68% of cases funds moved within an hour and in 22% within the first minute. Only $9.8 million had been returned to victims by the report's cutoff date.
Background
Keystone is not alone in dealing with supply-chain problems this year. Earlier in October, Ledger asked some resellers in Southeast Asia and Hong Kong to pause sales after reports of devices carrying unauthorised hardware implants able to capture recovery phrases. Coldcard investigated a phishing link posted on its official X account, and NGRAVE users were targeted through compromised wallet notifications in a campaign linked to roughly $2.65 million in losses. The pattern, Crypto Daily noted, is attackers going after the infrastructure around wallets rather than the cryptography itself.
What to watch
Keystone has not said when devices built with the replacement key will ship. Also unresolved is whether counterfeits carrying the exposed key surface on the market. The company is warning users about scams offering asset migration, wallet verification or investigation help, and the security guidance published around the incident points buyers toward official sales channels, recovery phrases generated fresh during setup and firmware verified independently of links sent by message or social media.
Questions readers ask
Are existing Keystone devices still safe to use?
Keystone says devices shipped before 20 October 2026 remain valid as long as they pass authentication checks.
Was my recovery phrase or private key exposed?
According to the company, no recovery phrases, private keys or payment information were affected; the exposed data covers contact, shipping and order details.
Why is Keystone destroying unsold wallets?
The authentication key cannot be removed or rewritten once written into a device, so unsold units carrying it cannot be re-secured and are being scrapped.
