Keystone destroys wallets after device verification key breach
Keystone will destroy 18,835 unsold hardware wallets after an attacker obtained the device-verification key used to establish whether a wallet is genuine. The company discovered unauthorized access to its website on October 20 and said the attacker also accessed customer data.
The incident does not involve wallet recovery phrases, private keys or the transaction-signing process. However, anyone holding the stolen verification key could build a counterfeit device capable of passing Keystone’s online authenticity check, creating a route to steal cryptocurrency from a buyer who trusted the fake hardware.
Why the verification key changes the risk
Keystone’s verification process asks an owner to scan a QR code from its verification page and enter the code displayed by the device. In the company’s open-source firmware, the QR code contains that value in encrypted form, and the device decrypts it with its stored key. A matching result demonstrates that the device holds the verification key.
That key is limited to the authenticity check. It is not used to generate recovery phrases, derive private keys or sign transactions. But a counterfeit device loaded with the compromised key could generate the correct verification response and therefore pass the check.
The key is written during manufacturing into memory that can be programmed only once. Existing devices cannot be migrated to a replacement key because the firmware rejects a second one. Keystone said newly manufactured devices will receive a new key, while the 18,835 unsold units carrying the old key will be destroyed.
Device guidance and affected customer records
Keystone said a device delivered before October 20 can be used normally if it passes authentication. For a device received after that date with the old key, a successful check cannot completely exclude the possibility of a counterfeit. Owners in that group should contact Keystone support and not use the device until its authenticity is confirmed.
Shipping from Keystone’s website is paused until wallets with the replacement key are ready. The company said the same delivery-date guidance applies to units purchased through Amazon or authorised resellers. It has not reported counterfeit devices or cryptocurrency thefts, and said owners do not need to move assets solely because of this incident.
The attacker exploited a vulnerability in a third-party data-monitoring tool used on Keystone’s website to escalate privileges, Keystone said. Access was blocked on October 20 and the vulnerability has since been fixed. The company has not stated when the intrusion began or where the verification key was stored.
Keystone reported that 25,964 buyer records from purchases on its website between 2024 and 2026 were affected. The records include names, contact details, delivery addresses and order information. Shopify stored and managed the online-store records; payment card, bank and government identification data were not involved, Keystone said, and Amazon and other sales channels were not affected.
The company also included 12,873 unpaid checkout records as a precaution. It acknowledged that some information should have been deleted after its stated 180-day retention period because its bulk-deletion tool did not reliably complete every deletion. Keystone has reduced its retention period to 90 days and asked Shopify to delete buyer data older than that limit.
Operational implications for owners and vendors
Keystone warns customers to treat calls, messages or emails offering refunds, replacements, recalls, wallet verification or help moving cryptocurrency as scams. It says it will not ask customers to return a device, and users should never enter a recovery phrase into hardware they did not order.
For businesses that hold digital assets or procure hardware wallets, the practical implication is to validate newly received devices through the manufacturer before funding them, use independently obtained contact channels for support, and test whether supplier data-retention and deletion controls actually work as intended.