Keystone Breach Deepens as 18,835 Crypto Hardware Wallets Face Destruction - Bitcoin News

What initially appeared to be a customer information breach has developed into a considerably more serious security problem for Keystone. On Oct. 26, 2026, the hardware wallet manufacturer disclosed that attackers obtained the authentication key used to verify whether its devices are genuine.

The company traced the intrusion to a vulnerability in a third-party data monitoring tool that allowed attackers to escalate their access privileges. Keystone detected suspicious activity Oct. 20, disabled vulnerable website functions, and launched a forensic investigation.

Compromised Authentication Key

The stolen WebAuth key presents a particularly uncomfortable problem. An attacker possessing it could manufacture counterfeit devices capable of passing Keystone's authenticity checks, potentially exposing buyers to asset theft.

Keystone explained that the key is permanently embedded during manufacturing and cannot be rewritten or erased. Consequently, the hardware wallet manufacturer plans to destroy all 18,835 devices in the existing inventory containing the compromised key. Newly manufactured wallets will receive a replacement authentication key.

We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.

Customer Data Exposure

The investigation also exposed a serious failure in Keystone's customer data management. Of 51,083 Shopify buyer records examined, 25,964 retained personal information, including names, shipping addresses, contact details, and purchase histories dating from 2024 through 2026.

Keystone acknowledged that its automated deletion system had malfunctioned, allowing customer information to remain stored beyond its 180-day retention policy. Investigators also identified 12,873 unpaid checkout records containing potentially sensitive customer information.

The manufacturer has shortened its retention period to 90 days, and expects overdue buyer data deletion requests submitted Oct. 24 to be finalized Nov. 3. Keystone has submitted regulatory reports in the EU, U.K., and other jurisdictions.

Customer Guidance

Keystone maintains that recovery phrases, private keys, wallet credentials, and payment information were not compromised. Customers aren't being instructed to move their cryptocurrency solely because of the incident.

Devices delivered before Oct. 20 remain safe to use if they pass authentication, the company says. Devices received afterward using the compromised key require additional verification through customer support, even if authentication succeeds.

Keystone has suspended shipments of outstanding website orders and switched to preorders until replacement production is ready. The company has also warned customers against fraudulent recall messages requesting device returns.