Keystone to Destroy 18,835 Wallets After Key Theft

Hardware-wallet maker Keystone will destroy 18,835 unsold devices after an attacker who breached its website stole the cryptographic key its wallets use to prove they are genuine. The company disclosed the theft on October 26, stressing that owners’ recovery phrases and private keys were never involved.

The danger lies in counterfeiting. Anyone holding the stolen key could build fake Keystone devices that pass the online authenticity check buyers rely on. A customer trusting such a counterfeit could ultimately have their crypto stolen, though Keystone has reported no fake devices or thefts so far.

The verification works by scanning a QR code on Keystone’s site, which carries an encrypted code the genuine device decrypts using its stored key. Because that key is used only for this check, it plays no role in generating recovery phrases or signing transactions, but a copy lets a counterfeit produce the correct codes.

Keystone discovered the unauthorised access on October 20 and blocked it the same day. The attacker had exploited a flaw in a third-party data-monitoring tool to escalate privileges, obtaining both the key and customer data. The vulnerability has since been fixed.

Guidance depends on timing. Devices received before October 20 that pass the check are genuine; those arriving afterwards with the old key should be verified with support first, as counterfeiting “cannot be completely ruled out.”

Because the key is permanently written during manufacturing and cannot be rewritten, existing devices can’t switch to the new one, forcing the destruction of all affected stock.

Separately, the breach exposed 25,964 buyer records (2024–2026) held on Shopify, including names, contacts and shipping addresses, plus 12,873 incomplete-checkout records. Keystone is cutting its data-retention period to 90 days and notifying affected customers.