Keystone Scraps 18,835 Hardware Wallets After Verification Key Stolen in Website Breach
Hardware wallet maker Keystone is destroying nearly 19,000 unsold devices after an attacker broke into its website and walked off with the cryptographic key used to prove its wallets are genuine.
The company confirmed on October 26 that someone had exploited a vulnerability in a third-party monitoring tool connected to its website, used it to escalate their privileges, and extracted both customer data and the device verification key. Keystone detected the intrusion on October 20 and blocked the attacker's access the same day.
The verification key is baked into every Keystone device during manufacturing and cannot be overwritten. That is by design, but it creates an awkward problem now: the 18,835 unsold devices carrying the compromised key cannot simply be updated. They have to go. New stock will ship with a replacement key.
To be clear about what this key actually does: when an owner wants to confirm their Keystone is legitimate, they scan a QR code on Keystone's verification page. The device decrypts an encrypted value from that code using its stored key and displays the result. A correct response confirms the device holds the right key. That is all the key does. It has no involvement in generating recovery phrases, deriving private keys, or signing transactions. Your funds are not directly at risk from this breach.
What is at risk is the integrity of the supply chain. Anyone holding a copy of that key could theoretically produce counterfeit devices that pass the verification check. A buyer who trusted the result could unknowingly use a compromised wallet and lose everything. Keystone says it has not found any counterfeit devices or thefts. That is reassuring, but the company also hasn't said how long the attacker had access before October 20, which somewhat limits how reassuring it can be.
What owners should actually do
If your device arrived before October 20 and passes the verification check, Keystone says you are fine. Use it normally.
If your device arrived after October 20 and carries the old key, do not use it until Keystone's support team confirms it is genuine. Contact them at [email protected]. As of October 27, Keystone's verification page still did not show the specific instructions it told these customers to follow, which is not a great look. The company has also not explained how owners can tell which key their device carries, or what to do if they have already sent crypto to a wallet on one of these unverified devices.
If you have an order in progress, shipping has been paused. The Keystone 3 Pro is currently listed as a pre-order with a four-to-six week lead time while devices with the new key are prepared.
If you bought through Amazon or a reseller, the same date-based guidance applies. Keystone hasn't confirmed whether old-key devices are still available through those channels.
You do not need to move your crypto just because this happened, unless your device falls into the post-October-20 category above.
And if anyone contacts you offering a refund, a replacement, a recall, or help moving your funds: that's a scam. Keystone will not ask you to return a device. Never enter your recovery phrase into any device you didn't personally order, and navigate to keyst.one by typing it yourself.
The data breach side of things
Separately from the key theft, the same attacker got hold of customer records. Keystone disclosed this on October 24 and followed up on October 26 with specifics: 25,964 buyer records from purchases made between 2024 and 2026 were exposed, along with 12,873 records from abandoned checkouts included as a precaution. The records contain names, contact details, shipping addresses, and order information. No payment card details, bank information, or government IDs were involved.
Keystone's store runs on Shopify, which held these records. The company had a policy of deleting shipping data 180 days after each order, but an automated deletion tool it built wasn't working reliably. Failures went unnoticed, meaning data that should have been gone was still sitting there.
In response, Keystone is cutting its data retention period from 180 days to 90 days immediately, has asked Shopify to purge records older than 90 days by November 3, and is emailing affected customers. As of October 27, its own privacy policy still stated 180 days. These things take time to update, apparently.
Affected customers will be able to check their exposure through a dedicated page Keystone says it is building. No timeline given on that.