Keystone to destroy 18,835 wallets after auth key theft

Hardware wallet maker Keystone says the attackers behind last week's website breach also stole the key it uses to prove its devices are genuine, and it will destroy 18,835 wallets in its inventory as a result. The company set out the details in a security update on Oct. 26, as reported by The Defiant and crypto.news.

What the attackers got

• Entry point: on Oct. 20 the attackers got into Keystone's official website through a vulnerability in a third-party data monitoring tool.
• Customer data: 25,964 purchase records with names, contact details, shipping addresses and order details from 2024 to 2026, plus 12,873 unpaid checkout records. Keystone found 51,083 purchase records in its Shopify store in total, but the personal data in 25,119 of them had already been erased.
• The WebAuth key: a device-authentication key written into every Keystone wallet at the factory and checked when buyers verify their device on Keystone's website.
• Not taken, per Keystone: recovery phrases, private keys, wallet credentials, payment details and government ID numbers.

Why a stolen check key matters

The WebAuth key plays no part in creating the seed phrase, deriving keys or signing transactions. But whoever holds it could build counterfeit wallets that pass Keystone's official authenticity check, the step meant to catch fakes. Because the key cannot be erased or rewritten once a device is made, Keystone says it will:

• destroy all 18,835 stocked devices carrying the old key;
• move production to a new key and pause shipping of unfulfilled website orders, selling on preorder until new units are ready;
• cut how long it keeps customer data from 180 to 90 days, a point buyers had questioned after older orders turned up in the leak.

What owners should do

Wallets delivered before Oct. 20 that pass authentication remain safe to use, Keystone says, and holders do not need to move funds. If you received a device after Oct. 20 that uses the old key, contact Keystone support for additional checks before loading funds, even if the website check passes. Keystone is not recalling devices: treat anyone who asks you to send a wallet back as a scammer. Our step-by-step guide on how to check if a hardware wallet is genuine explains the other signs of a tampered device, and never share your seed phrase with anyone.