Cryptocurrency hardware wallet manufacturer Keystone has disclosed a significant security breach that compromised both customer shipping records and a critical cryptographic key used to verify the authenticity of its devices. The incident, announced by the company in a series of statements starting late October 2026, has forced Keystone to scrap nearly 19,000 unsold hardware wallets and overhaul its internal data retention policies.
According to Keystone, an unauthorized actor gained access to its website by exploiting a vulnerability in a third-party data monitoring tool. This security flaw allowed the attacker to escalate privileges within the system, subsequently granting them access to sensitive customer data and the proprietary key utilized by Keystone’s hardware wallets to prove they are genuine products.
The breach was first partially acknowledged on October 24, when the company revealed that a third party had obtained customer shipping information. Subsequent investigations by Keystone uncovered the full scope of the incident, which impacts thousands of buyers and introduces unique verification challenges for users who recently purchased the company’s hardware wallets.
The Compromise of the Device Authentication Key
The most critical technical aspect of the breach involves the key that Keystone hardware wallets use during the online authentication process. Under normal operating conditions, when a user purchases a new Keystone device, they verify its legitimacy by visiting an online verification page, scanning a QR code displayed on the page with the device, and entering a secondary code generated by the hardware wallet.
In Keystone’s open-source firmware, this mechanism relies on the QR code carrying an encrypted string that the device decrypts using its internally stored key. A successful decryption and matching response confirm to the user that the hardware is genuine.
However, because the attacker successfully obtained a copy of this specific key, malicious actors could theoretically manufacture counterfeit devices programmed with the same key. These fraudulent devices would successfully pass the online authentication check, potentially tricking unsuspecting buyers into trusting a compromised hardware wallet. If a user were to load cryptocurrency onto such a counterfeit device, their funds could be stolen.
Keystone has emphasized that the compromised key is used exclusively for the online verification check. It plays no role whatsoever in the creation of user recovery phrases, the derivation of private keys, or the signing of cryptocurrency transactions. Furthermore, the company has stated that it has not received any reports of counterfeit devices in circulation or actual cryptocurrency thefts resulting from the incident.
Because the verification key is permanently written into each device during the manufacturing process and stored in write-once memory, it cannot be erased, rewritten, or updated via firmware patches. Consequently, devices that have already been manufactured cannot be switched to a new key. To mitigate the risk, Keystone has announced plans to destroy 18,835 unsold devices that carry the compromised key, while all newly manufactured units will be provisioned with a secure, replacement key.
Customer Guidance and Verification Protocols
Keystone successfully blocked the attacker’s unauthorized access on October 20 and has since patched the vulnerability in the third-party monitoring tool. However, the company’s advice to existing device owners varies significantly depending on the delivery date of their hardware.
For customers who received a device after October 20 that incorporates the old, compromised key, Keystone has issued a stark warning. The company noted that even if such a device successfully passes the standard online authentication check, it is impossible to completely rule out the possibility of it being a counterfeit. Affected owners of devices delivered after that date are advised to contact Keystone support and refrain from using the hardware until the company can manually confirm its authenticity.
Conversely, Keystone has stated that devices delivered prior to October 20 that pass the verification check can be considered genuine and safely used for normal operations. The company has not yet disclosed the exact timeline of when the attacker first breached its systems prior to the October 20 cutoff.
Scale of the Customer Data Exposure
In addition to the hardware verification concerns, the breach exposed a substantial volume of customer personal data. Keystone confirmed that the incident affected 25,964 buyer records generated through purchases made on its official website between 2024 and 2026.
These exposed records include customers’ full names, contact details, shipping addresses, and specific order details. The company’s online retail operations are hosted on Shopify, which served as the repository for these records. Keystone has clarified that sensitive financial information—such as payment card numbers, bank details, and government-issued identification numbers—was not involved in the breach. Furthermore, purchases made through Amazon or other external sales channels remained entirely unaffected.
As a precaution, Keystone has also included 12,873 unpaid checkout records in its response. These records contain names, contact details, and shipping information from customers who initiated a purchase process on the website but never completed the transaction.
A notable finding from the investigation centers on Keystone’s internal data retention practices. The exposed records included data that should have already been purged from the company’s systems. Keystone maintains a publicly stated privacy policy promising to delete customer shipping information 180 days after the completion of each order. However, an automated internal tool designed to execute these bulk deletions failed to operate reliably over time, resulting in failed deletions that went unnoticed by the company.
In the wake of the breach, Keystone is taking immediate steps to rectify its data governance framework. The company is shortening its personal data retention window from 180 days to 90 days, effective immediately. Additionally, Keystone has formally requested that Shopify purge all customer personal data older than 90 days, a process expected to be completed shortly. The company is also in the process of notifying all affected customers directly via email and is developing a dedicated lookup portal to allow individuals to check whether their personal information was compromised in the incident.
