Diwali Sale is live — Enjoy up to 60% off →

Keystone will destroy 18,835 hardware wallets after hackers steal its authenticity key

The stolen key is burned into every device at the factory and cannot be changed, so fake wallets could now pass Keystone's own genuineness check.

27 October 2026 • 8 min read

Keystone will destroy 18,835 hardware wallets after hackers steal its authenticity key

Somewhere in Keystone's inventory sit 18,835 new hardware wallets that will never be sold. Nothing is physically wrong with them. They all carry the old authentication key, and as of last week the attacker has obtained it.

Keystone, which makes air-gapped wallets that keep crypto keys offline, said Monday it will destroy 18,835 unsold devices after attackers obtained the key that proves its hardware is genuine. The company has also suspended shipping of all unshipped orders from its website. The admission widens a story that began Saturday, when Keystone said a third party had obtained customer shipping information.

What was stolen is what Keystone calls the WebAuth key, a secret code written into each device at the factory so a page on the company's website can confirm the hardware is real. It cannot be erased or rewritten. According to the company, the key has no role in creating recovery phrases, deriving private keys or signing transactions.

So nobody's seed phrase leaked, and no wallet has been drained by this breach. The danger sits further upstream, in the box a buyer opens. Keystone put it plainly in its statement: "If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks." Those devices, it added, "could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft."

To run the check, the owner scans a QR code on Keystone's verification page with the device, then enters the code the device displays on the page. The Hacker News reports that in Keystone's open-source firmware, the QR code carries that code in encrypted form, and the device decrypts it with its stored key. Keystone has warned that a counterfeit built with the stolen key could pass the same check.

What to do depends on when your device arrived

Keystone found the unauthorized access on October 20 and sorts its advice to owners around that date.

Devices delivered before October 20 that pass the check can be considered genuine and used normally, according to Keystone.
For devices received after October 20 with the old key, Keystone says: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit." Do not use the device until Keystone support, at support@keyst.one, confirms it is genuine. Users do not need to return the devices.
Website orders are on hold until devices with the new key are ready. As of October 27, the store listed the Keystone 3 Pro as a pre-order expected to ship within 4 to 6 weeks.

Gaps remain in the guidance. Keystone has not said how to tell which key a device carries, or what owners who have already sent crypto to such a device should do. It also told post-October 20 owners to follow instructions on its verification page, but the page showed no such instructions as of October 27.

Keystone said users do not need to move funds because of the breach alone, CoinDesk reported. Expect fake outreach, though. The company's line is direct: "We will not ask you to return the device. Anyone who contacts you claiming it is a 'recall' and asks you to ship the device to them should be considered a scammer."

Keystone's whole sorting scheme rests on the October 20 cutoff. Older devices are treated as safe because Keystone bases that assessment on the date it discovered the unauthorized access. But the company has not said when the attacker first got in, or where the key was stored. If the intrusion started earlier than October 20, the safe line would have to move back, and for now owners are relying on Keystone's word that it hasn't. So far the company has not confirmed any instances of counterfeit devices exploiting the compromised key.

25,964 buyers who should already have been deleted

A broken promise lies behind the customer data leak. Keystone says its official Shopify store had produced 51,083 purchase records. Of those, 25,119 had been deleted under the 180-day rule. The remaining 25,964, dating from 2024 to 2026, may have been stolen, and they include names, contact details, shipping addresses and order details. The intruder may also have obtained access to 12,873 abandoned checkout records stored by Shopify, entries left by incomplete transactions.

The company blamed its own tooling. "The tool did not operate reliably," it said. "Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period." The attacker got in through a different tool, exploiting a vulnerability in a third-party data monitoring tool used by Keystone's website to escalate privileges. Keystone blocked the attacker's access on October 20 and has since fixed the vulnerability.

Keystone is shortening the period it retains customers' personal data from 180 days to 90 days, effective immediately. It has asked Shopify to delete buyers' personal data older than 90 days and expects that to be done on November 3. As of October 27, its privacy policy still listed 180 days. Keystone says seeds, private keys, bank payment info, and government IDs are safe, and its Amazon sales weren't affected.

A leaked shipping record from a hardware wallet store connects a name and a home address to crypto ownership. That draws phishers, and it can draw people who turn up at the door. The two halves of the breach also fit together badly: Keystone's warning describes counterfeits being "shipped" to customers, and whoever stole the key may also hold a list of real buyers and where they live. Nothing shows anyone has tried that combination, but a parcel or email citing a real past order is far harder to dismiss than a cold phishing attempt.

A passing check now means less than it did

Keystone's own guide says device verification helps detect potential tampering during transportation, prevents supply chain attacks, and ensures that the installed firmware is safe and trustworthy. For a large group of devices, that claim no longer holds on its own. Defiprime found that the page's general FAQ still said that passing verification confirms genuine, untampered hardware and firmware. The disclosure limits that assurance for old-key devices received after October 20.

That leaves provenance as the practical defence. Buy from the manufacturer or its authorized resellers, and keep the order confirmation and the delivery date, because that date now decides whether a Keystone can be trusted. Never use a seed phrase that came pre-printed in the box; a hardware wallet should generate its own.

Cointelegraph noted that the incident adds to a series of attacks targeting hardware wallet manufacturers this year. One competitor has already reacted. Hardware wallet maker OneKey will keep personal information linked to customer orders for no more than 30 days across all systems it controls, founder Yishi said on Tuesday, October 27, 2026. The company said the change is precautionary and that it has not experienced a security breach.