Keystone says hackers also stole its device authentication key; 18,835 units to be destroyed

Keystone, a maker of hardware wallets that keep private keys on a device offline, said the attacker who breached its website last week obtained not only customer data but also the key it uses to verify whether its devices are genuine. In an incident report posted on its official X account late on Oct. 26 KST, the company said it will destroy 18,835 devices in inventory that contain the key and has suspended shipping of all orders placed on its official website. The disclosure widens the impact to devices a day after Keystone first acknowledged the shipping data leak on Oct. 25.

A factory-installed key that cannot be erased

According to Keystone, the attacker exploited a vulnerability in a third-party data monitoring tool used by its website to escalate privileges, which enabled the attacker to obtain some customer information and the device authentication key. Keystone uses the key in the WebAuth process on its official device authentication page to verify whether a device is genuine.

The key is written into devices during manufacturing and cannot be erased or rewritten. The company said the key is not used to generate recovery phrases, derive private keys or sign transactions. The problem is the authenticity check itself. Keystone said that if the key is exposed, an attacker could produce counterfeit devices that pass authentication checks, and that such devices could be sold or shipped to customers who might unknowingly use them as genuine products, potentially resulting in asset theft.

18,835 units scrapped, shipping suspended until new-key devices are ready

Keystone said production stopped using the old key effective immediately and that all newly manufactured devices will use a new authentication key. The 18,835 devices in inventory that contain the old key will be destroyed rather than sold or shipped. Shipping of all unshipped orders from the official website has been suspended, and sales will switch to a preorder model until production of new-key devices is complete.

Guidance for existing users hinges on Oct. 20, the date the company discovered the unauthorized access. Devices delivered before that date are unaffected and can be considered genuine and used normally if they pass authentication, Keystone said. For old-key devices received after Oct. 20, the company said it cannot completely rule out that a device is counterfeit even if it passes authentication, and asked owners to contact customer support for additional verification through the authentication page and use the device only after its authenticity is confirmed.

A broken bulk-deletion tool behind the missed 180-day promise

Keystone also disclosed the scale of the personal data exposure for the first time. The incident involved 51,083 buyer records generated by purchases through the Shopify store on its official website. Personal information tied to 25,119 of them had already been erased under its retention policy, while the remaining 25,964 records, covering 2024 to 2026, still contained names, contact details, shipping addresses and order information. Purchase data from Amazon and other sales channels was not affected. The company also included 12,873 checkout records for which payment was not completed, which contained names, contact details and shipping information.

The company's promise, advertised on its website, to erase shipping data 180 days after an order was not kept. Keystone said that because erasing records one by one in Shopify was inefficient, it built an automated tool for bulk erasure, but "the tool did not operate reliably," and it did not detect the failed erasure tasks in time. The company submitted erasure requests to Shopify on Oct. 24, and after a 10-day waiting period the erasure is expected to be completed on Nov. 3. It is shortening its retention period for customer personal information from 180 days to 90 days. Keystone said it will notify affected customers individually by email and plans to launch a page where users can check whether their data was affected. It said reports have already been submitted to authorities in the EU, the U.K. and other jurisdictions.