Keystone announced on October 26 that it will destroy 18,835 unsold hardware wallets after an attacker who accessed the company's website obtained the key those devices use to prove they are genuine.
Keystone's timeline and immediate actions
Keystone detected unauthorized access to its website on October 20 and blocked the attacker's access that same day, the company said. It first disclosed the breach on October 24, saying a third party had obtained customers' shipping information, and provided additional details in a statement on October 26. Keystone said the attacker obtained both customer data and the device verification key. The company has fixed the exploited vulnerability and will destroy 18,835 unsold devices that carry the compromised key; all new devices will receive a new key.
How the device verification check works — and what the stolen key enables
Keystone's online verification relies on a challenge in a QR code. An owner scans a QR code on Keystone's verification page with the device, then enters the code the device displays on the page. In Keystone's open-source firmware, the QR code carries an encrypted code that the device decrypts with its stored key; a correct code indicates the device holds the key. The key is used only for this check and "plays no part in creating recovery phrases, deriving private keys, or signing transactions," the company said.
Because anyone with a copy of the key could produce the right codes, a counterfeit device carrying that key could pass the online check. Keystone warned such a counterfeit could be sold or shipped to customers and lead to theft of crypto. The company has not reported any counterfeit devices or thefts to date.
Crucially, the key is written into each device during manufacturing and cannot be erased or rewritten: the firmware keeps it in memory which "can be written only once" and refuses a second key. That means devices already made cannot be switched to the new key, a constraint that underlies Keystone's decision to destroy unsold units bearing the old key.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCustomer records, Shopify, and retention changes
Keystone said 25,964 buyer records from purchases on its website between 2024 and 2026 were affected. Those records include names, contact details, shipping addresses, and order details; payment card and bank details and government ID numbers were not involved. Keystone's online store runs on Shopify, which stored and managed the records. The company also included 12,873 unpaid checkout records in its response as a precaution; those contain names, contact details, and shipping information from purchases that were never completed.
Keystone acknowledged that some affected data should already have been deleted under its previous policy of erasing shipping information 180 days after each order; an automated tool Keystone built to erase records in bulk "did not work reliably" and some deletions failed without timely detection. The company is shortening its retention period from 180 days to 90 days effective immediately, has asked Shopify to delete buyers' personal data older than 90 days and expects that deletion to be completed by November 3. As of October 27, Keystone's privacy policy still listed 180 days. Keystone is emailing affected customers and plans a page where people can check whether their information was affected.
Guidance for owners, buyers, and resellers
Keystone's guidance differentiates devices by arrival date:
- Delivered before October 20: A device that passes the check can be considered genuine and used normally, Keystone said.
- Received after October 20 with the old key: Owners should not use the device until Keystone support at support@keyst.one confirms it is genuine. Keystone told these owners to follow instructions on its device verification page, though the page showed no such instructions as of October 27. The company has not said how to tell which key a device carries, or what owners who have already sent crypto to such a device should do.
- Waiting on an order from Keystone's website: Shipping is paused until devices with the new key are ready. As of October 27, the store listed the Keystone 3 Pro as a pre-order expected to ship within 4 to 6 weeks.
- Bought through Amazon or a reseller: The same guidance applies because it is based on when a device arrived, not where it was bought. Keystone sells through Amazon official stores and authorized resellers, but the company has not said whether devices with the old key are still on sale there.
Keystone also advised that owners already holding crypto do not need to move it solely because of the incident, but reiterated the verification steps for devices received after October 20 with the old key. The company warned customers to treat any call, text, email, or letter offering a refund, replacement device, recall, wallet verification, or help moving crypto as a scam; Keystone said it will not ask anyone to return a device. The company emphasized never to enter a recovery phrase into a device you did not order and to type keyst.one into a browser instead of following links.
What this means for security teams, resellers, and end users
Security teams: The incident centers on a website compromise and an exploited vulnerability in a third‑party data monitoring tool that allowed privilege escalation and exfiltration of both data and a device authentication key. Teams will watch for counterfeit devices passing online checks and should note the limits of on-device, factory‑written keys that cannot be rotated after manufacture.
Resellers and marketplaces (Amazon, authorized resellers): Shipping from Keystone's own store is paused until new-key devices are ready; resellers should track inventory dates and buyer communications because Keystone has not said whether old-key devices remain available through third-party channels.
End users and buyers: If your device arrived after October 20, follow Keystone's verification process and contact support@keyst.one before using it if it carries the old key; do not trust unsolicited offers to help or to move funds, and do not enter recovery phrases into devices you did not order.
Keystone says it has blocked the attacker's access and fixed the exploited vulnerability, but has not said when the attacker first gained entry, where the verification key had been stored, whether counterfeit devices have been made or sold, or what owners who already sent crypto to a device with the old key should do. Those unanswered specifics will shape whether the destruction of unsold units and the new-key rollout fully closes the window opened by the breach.
