Keystone, a hardware wallet maker, announced on October 26, 2026 that unauthorized access to its official website led to the theft of the authentication keys used to verify that its devices are genuine. The company says it will destroy 18,835 units of unshipped inventory that had been loaded with the compromised keys.
The stolen authentication key, which the company calls the “WebAuth key,” is written to each device at the time of manufacture and cannot be erased or replaced afterward. Keystone explains that if the key is misused, someone could build counterfeit devices that pass the authenticity check.
Devices made from now on will use a new key, and the company is halting shipment of unshipped orders until preparations are complete. For the time being, sales on its official website are limited to pre-orders only.
Devices that arrived before the 20th of this month can continue to be used as long as they pass the authenticity check. However, anyone who received a device with the old key on or after that date is asked to verify it with official support before using it, since a device could be a counterfeit even if it passes the check.
The company says recovery phrases, private keys, payment information, and government ID numbers were not affected, and that users do not need to move their assets solely because of this incident. In a statement, Keystone said, “We failed to keep our promise to delete customer data by the deadline. We take responsibility for that.”
According to Keystone, the intruder exploited a vulnerability in an external data-monitoring tool to escalate privileges. The company detected the unauthorized access on the 20th of this month, confirmed on the 23rd that customers’ shipping information had been obtained, and issued its first report on X on the 24th.
Of the 51,083 order records on Shopify, 25,119 had already had their personal information erased. The remaining 25,964 records (purchases made between 2024 and 2026) contained names, contact details, shipping addresses, and order contents. That means records still holding personal information account for more than half of the total. In addition, 12,873 records of checkouts that were never completed could also be affected, and the actual number of people involved is not yet known.
The company had a policy of deleting customer data within 180 days of an order, but its automatic deletion mechanism partly failed, and the company did not notice. It has shortened the retention period to 90 days, and on the 24th of this month it asked Shopify to erase the personal information of all purchasers beyond the 90-day mark. The company says it has already reported the incident to regulators in the EU, the UK, and elsewhere.
Leaks of hardware wallet buyers’ information had also occurred in a series of incidents in August. On August 13, Trezor disclosed that unauthorized access to its shipping contractor ShipMonk had exposed the information of 13,689 customers. SafePal likewise revealed on August 16 that a flaw in its order-tracking system had leaked the names and addresses of 39,798 people.
Both companies said that devices and private keys were not affected. What sets the Keystone incident apart is that, in addition to buyers’ information, the key behind the mechanism used to verify a device’s authenticity was also stolen.
Keystone is warning customers that any contact offering refunds, replacement devices, address changes, asset transfers, or wallet verification is not from the company. It also urged people to treat anyone who asks them to return a device under the pretext of a recall as a scammer. In addition, it is urging customers never to enter a recovery phrase on a device they did not order.
Image: Shutterstock
Chronicles of Market Turbulence: Reflecting on the Cryptocurrency Industry's Past
Major Indian Exchange CoinDCX Reports 15.99 Million USDT Outflow from Old Wallet
