Keystone breach deepens: Hackers stole key used to verify wallets as genuine
Hardware wallet manufacturer Keystone disclosed on Monday that hackers who breached its website last week also stole a key used to verify the authenticity of its devices, widening the scope of an incident initially reported as a customer data leak.
Keystone stated that the attacker exploited a vulnerability in a third-party monitoring tool used by its website to escalate privileges. This allowed them to obtain some customer information and a key used to verify the authenticity of Keystone's devices.
These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.
Company response and device destruction
Keystone said it plans to destroy 18,835 devices in its inventory that contain the compromised key and has suspended production shipments of all devices using it. Shipments would resume once the company begins producing devices with a new authentication key.
The company said devices manufactured and delivered before the October 20 incident should be considered safe and that their authenticity checks remain trustworthy. However, it could not guarantee the authenticity of devices delivered after that date.
Keystone urged affected customers to contact its support team for additional verification. The company also said it had contacted Shopify to request the deletion of personal information in checkout records retained for more than 30 days.
Customer data breach details
Keystone also disclosed the extent of the customer data breach, saying its website’s Shopify store had generated 51,083 buyer records. Of those, 25,119 had been deleted per its 180-day data retention policy.
The remaining 25,964 records dating from 2024 to 2026 were stolen by the attacker. Keystone said the older entries were not deleted due to a failure in its automated tool used to handle bulk erasure of data.
The attacker managed to steal another 12,873 customer checkout records retained by Shopify — information from purchases that had not been completed.
Industry-wide security concerns
The incident adds to a series of attacks targeting hardware wallet manufacturers this year. Earlier this month, Ledger asked resellers across Southeast Asia and Hong Kong to suspend sales following reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases.
In late July, Coldcard manufacturer Coinkite issued a warning to users after attackers exploited a bug that caused its devices to generate wallet seeds with less entropy than intended, resulting in the theft of millions of dollars in crypto.
Other hardware wallet manufacturers have also suffered breaches involving customer information and third-party services this year. In August, Trezor disclosed a breach at its shipping partner that exposed customer information, with the number of affected users expanding to more than 80,000 in September.
Related
