Keystone, which makes hardware wallets for Bitcoin and other crypto, says attackers have stolen the key it uses to prove its devices are genuine.
The company will destroy 18,835 unsold devices that carry the compromised key. It has suspended shipping of unshipped orders from its website, and is switching website sales to pre-orders until devices with a new key are made.
The breach was detected on 20 October. Keystone says recovery phrases and private keys were not affected, and no stolen funds had been reported at the time of writing.
Why the key matters
The key, which Keystone calls its “WebAuth” key, is written into every device at the factory. It lets a page on Keystone’s website confirm that a device is genuine.
“If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks,” Keystone said.
The risk is that a fake device could pass Keystone’s own check, be sold or shipped to a customer, and then be loaded with real funds.
Keystone says devices delivered before 20 October are not affected.
Customer data exposed
Attackers also obtained 25,964 buyer records from Keystone’s Shopify store, covering 2024 to 2026. The records include names, contact details, shipping addresses and order information.
Keystone says Amazon and its other sales channels were not affected.
Keystone said its policy was to delete buyer records after 180 days, but its automated deletion tool did not work reliably, so some data was kept longer than it should have been.
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company said. It has cut its data retention period to 90 days.
What users should watch for
Keystone warned users to be wary of anyone offering “asset migration,” “wallet verification” or “investigation assistance.”
“We will not ask you to return your device,” the company said. Anyone asking a customer to ship their device under the pretext of a recall should be treated as a scammer.
Keystone says it has reported the incident to authorities in the EU, the UK and elsewhere.
What happens next
Keystone expects the deletion of old buyer data to be completed by 3 November. Who carried out the attack, and when they first got in, had not been disclosed at the time of writing.
