Keystone to Destroy 18,835 Hardware Wallets After Key Theft

Keystone announced it will destroy 18,835 unsold hardware wallets after an attacker stole the device verification key. The unauthorized access was discovered on October 20, when the attacker exploited a vulnerability in a third-party data monitoring tool to escalate privileges. Keystone blocked the access and fixed the vulnerability on the same day. The stolen key allows attackers to build counterfeit devices that pass online verification checks, though the incident did not involve owners' recovery phrases or wallet private keys.

The breach affected 25,964 buyer records from purchases between 2024 and 2026, including names, contact details, shipping addresses, and order details. Payment card and bank details were not involved. Keystone included 12,873 unpaid checkout records in its response as a precaution. Devices delivered before October 20 that pass the verification check can be considered genuine. Owners of devices received after October 20 with the old key must contact support before using them.

Keystone is shortening the data retention period from 180 days to 90 days effective immediately. The company expects Shopify to delete buyers' personal data older than 90 days by November 3. Keystone has submitted reports to authorities in the EU, UK, and other jurisdictions. Owners do not need to move their crypto just because of this incident. Keystone warned that any messages offering refunds, replacements, or wallet verification are scams.