Keystone Will Destroy 18,835 Hardware Wallets After a Stolen Key Undermines Device Checks
•
October 27, 2026 11:10 pm
•
Comments
Hardware-wallet maker Keystone says it will destroy 18,835 devices after an attacker obtained a key used to verify whether its products are genuine—a supply-chain failure that goes well beyond an ordinary customer-data leak.
The company says recovery phrases, private keys, wallet passwords and payment-card details were not exposed. That is the critical distinction for current owners.
The incident did not hand an attacker the keys to users’ cryptocurrency. It undermined an authenticity check designed to help buyers determine whether a device came from Keystone rather than a counterfeiter.
Keystone first disclosed that unauthorized access to its website exposed customer shipping information held through its Shopify store. In its initial public statement, the company said names, contact information, shipping addresses and order details were affected.
It warned that criminals could use those details for highly targeted phishing calls, messages, emails or even physical mail.
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…
— Keystone Hardware Wallet (@KeystoneWallet) October 24, 2026
The more serious operational problem emerged in Keystone’s fuller incident report: the attacker also obtained a WebAuth key used in the company’s device-authentication process. That key does not control funds and is not a wallet recovery phrase.
Its danger is different. A counterfeiter with the key could potentially produce a device that passes the company’s normal genuineness check.
Decrypt’s report on Keystone’s response says the company is destroying 18,835 unsold devices that contain the old authentication key and has suspended shipments while it moves production to a new key. Keystone says devices delivered before October 20 remain safe to authenticate under the old system, while customers receiving devices after that date should contact the company for additional verification.
Destroying the inventory is expensive, but it is the only clean way to keep known-key devices from entering the retail channel after the trust mechanism has been compromised. A hardware wallet is sold on the promise that the customer can verify both the device and the software chain around it.
Once the manufacturer’s own check can no longer distinguish genuine inventory from a sophisticated counterfeit, the inventory itself becomes a liability.
— Keystone Hardware Wallet (@KeystoneWallet) October 26, 2026
CoinDesk’s coverage of the incident notes that the exposed buyer records create a ready-made target list. A criminal may know that a person bought a hardware wallet, where it was shipped and how to contact the buyer. That information can make a fake replacement-device offer or support message far more convincing.
Keystone’s advice is therefore worth treating as a standing rule: never enter a recovery phrase into a device you did not knowingly order, and do not trust an unexpected link or replacement offer merely because the sender knows accurate details about your purchase. Independently type the company’s known address or use a previously trusted support route.
Owners of devices received before October 20 should not confuse the authentication-key theft with a theft of their wallet secrets. Keystone says those earlier devices remain genuine and that private keys were not exposed.
The immediate risk is impersonation and supply-chain fraud, not remote draining of every Keystone wallet.
Buyers with an unshipped order or a device received after October 20 have a different problem: they need direct confirmation from Keystone before relying on the old authenticity check. More broadly, the incident is a reminder that hardware security depends on more than the secure element inside a wallet.
Customer databases, ecommerce systems, factory keys, packaging and distribution channels are all part of the same trust chain.
Join the conversation!
We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.