From Decrypt · By Jose Antonio Lanz
In brief
Keystone will destroy 18,835 unsold hardware wallets and has suspended shipping after an attacker obtained the permanent factory key used to verify its devices are genuine.
The breach, detected October 20, also affected 25,964 buyer records from Keystone's Shopify store, covering 2024 to 2026 and including names, contact details and shipping addresses.
Keystone says recovery phrases and private keys were not involved, and that devices delivered before October 20 are unaffected.
Keystone, a maker of Bitcoin hardware wallets that keep the secret codes controlling your crypto offline, said Monday it will destroy 18,835 unsold devices after attackers obtained the key that proves its hardware is genuine. The company has also suspended shipping of all unshipped orders from its website.
For buyers, the risk is a counterfeit wallet that looks brand new and passes Keystone’s own verification check, because the attacker obtained the key that the check relies on. A criminal could then sell such a device to someone who loads real savings onto it.
Myriad: How high will Bitcoin go? Click to make your prediction.
“If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks,” Keystone said in its statement. “These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.”
Keystone calls it a WebAuth key, a secret code written into each device at the factory so a page on the company’s website can confirm the hardware is real. It cannot be erased or rewritten, and the 18,835 units in inventory that carry it are being destroyed rather than sold.
Keystone first said Saturday that a third party had obtained customer shipping information. Monday’s statement added the stolen key and a count of 25,964 affected buyer records, but it does not say who is responsible or when the attacker first got in.
The incident affected records from Keystone’s Shopify store, the e-commerce platform that handled its online sales. Keystone says 51,083 buyer records were involved, but 25,119 had already had their personal information erased, leaving 25,964 from 2024 to 2026 that still held names, contact details, shipping addresses and order information. Purchases through Amazon and other channels were not affected.
BitcoinBTC · USD$80,622−2.32%Oct 20Oct 22Oct 24Oct 26Oct 27$84.8k$83.1k$81.3k$79.6k24h HighHigh$80,57324h LowLow$79,416VolVol$1.0B→Buy Bitcoin with USDTPowered by JupiterPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →Some of that data should already have been deleted. Keystone’s policy was to erase buyer records after 180 days, and the automated bulk-deletion tool it built for the job did not work reliably.