Keystone to destroy 18,835 hardware wallets after attacker obtains device authenticity key

TLDR

• Keystone says an attacker obtained a device authenticity key through a third-party monitoring tool flaw, plus 25,964 buyer records.¹²
• Keystone will destroy 18,835 unsold wallets carrying the old key, suspend shipments and use a new key in new devices.¹
• Some records outlived Keystone's 180-day deletion policy after an automated tool failed; retention is now 90 days.¹²

Hardware wallet maker Keystone says an attacker exploited a vulnerability in a third-party data monitoring tool used by its website to escalate privileges, obtaining some customer information and a key used to verify the authenticity of its devices.¹ The company says it will destroy the 18,835 devices in inventory that carry the old key, suspend shipping of all unshipped website orders, and switch website sales to preorders until devices with a new key are made.¹ CoinDesk reports that the attacker gained access on 20 October, while Keystone's statement says its security monitoring detected unusual access that day, and The Hacker News notes the company has not said when the attacker first got in.¹²³

The key is written into each device during manufacturing and cannot be erased or rewritten, Keystone says, and it is used only to verify authenticity, not to generate recovery phrases, derive private keys or sign transactions.¹ Keystone says an attacker holding it could produce counterfeit devices that pass authentication checks and are sold or shipped to customers.¹ The Hacker News reports that the firmware keeps the key in write-once memory, so devices already made cannot be switched to a new one, and that the company has not reported any counterfeit devices or thefts.³ Keystone says the incident did not involve recovery phrases, wallet private keys or other wallet credentials, and that owners do not need to move assets because of it.¹

On customer data, Keystone says 51,083 buyer records from its Shopify store were involved, 25,119 of which had already had personal information erased, leaving 25,964 records from 2024 to 2026 with names, contact details, shipping addresses and order information.¹⁴ It also included 12,873 unpaid checkout records as a precaution, and says purchases through Amazon and other channels were not affected.¹ Under Keystone's policy, buyer records should be erased after 180 days, but an automated bulk-erasure tool it built did not operate reliably and the failures went undetected, which Keystone says it accepts responsibility for.¹² Keystone is cutting retention to 90 days, says it asked Shopify on 24 October to erase overdue data with completion expected on 3 November, and The Hacker News reports its privacy policy still listed 180 days on 27 October.¹³

Keystone says devices delivered before 20 October that pass the authenticity check can be considered genuine, while devices received after that date with the old key should be used only once Keystone confirms they are genuine.¹ The Hacker News reports that the device verification page showed no such instructions as of 27 October.³ CoinDesk separately reports that Foundation, maker of the Passport wallet, disclosed its own breach involving phishing emails that appeared to come from its official domains, and Foundation says Passport devices were not compromised.²⁵

Why it matters: an authenticity key that cannot be rewritten leaves Keystone's online genuineness check open to counterfeits, according to Keystone, so owners who received devices after 20 October with the old key are told to wait for support to confirm theirs is genuine.¹³