Keystone plans to destroy 18,835 unsold hardware wallets after an attacker stole the key used to verify whether its devices are genuine. The Hacker News reports that the company detected unauthorized website access on October 20 and disclosed the key theft on October 26.
The incident also exposed customer information. Keystone says recovery phrases and wallet private keys were not involved. The immediate hardware concern is that a counterfeit device could pass the company’s authenticity check.
What the stolen key proves
Keystone’s verification process starts with the wallet scanning a QR code on its website. The owner then enters the response shown on the device’s screen. The published firmware decrypts the challenge using a stored key. The right response shows that the device holds that key.
Anyone with the stolen key could copy that response. A successful check can no longer reliably distinguish a genuine wallet from a counterfeit. The breach does not establish that funds in existing wallets were stolen.
The manufacturing code stores the key in memory that can be written only once. It rejects a new key if one is already stored. Keystone says new production will use a replacement key. Existing inventory cannot receive that replacement through a firmware update.
Keystone says its firmware signing key was unaffected. Our PGP guide covers checking software signatures. Those checks do not establish whether the hardware itself is genuine.
Customer records stayed too long
The Hacker News reports 25,964 affected buyer records from 2024 through 2026, containing names, contact details, shipping addresses, and order information. Keystone also included 12,873 unpaid checkout records in its response as a precaution. These counts are records, not necessarily distinct people.
Keystone acknowledged that its automated deletion tool failed and that it missed those failures. It announced a shorter retention period of 90 days and expected overdue deletion requests to finish on November 3. At our November 2 check, its privacy policy still described a 180-day period. An announced cleanup is not confirmation that deletion has finished.
Delivery date changes the advice
In its October 26 statement, available through a public mirror, Keystone says devices delivered before October 20 can be used normally if they pass authentication. Devices received after that date with the old key need additional support verification before use, even if the online check passes.
That cutoff is the company’s guidance, not an independently established date for the attacker’s first access. If your delivery date or key version is unclear, contact support@keyst.one before relying on the check.
Keystone says owners need not move assets solely because of this incident and that it will not request device returns. Treat unsolicited recall or migration instructions as suspicious. Never disclose your recovery phrase to someone offering help.
Exposed shipping details could make a fraudulent replacement offer sound convincing. Verify the sender independently before acting, and keep recovery information offline.