Hardware-wallet maker Keystone is about to destroy 18,835 unsold devices. Nothing is physically wrong with them. The problem is a secret they all carry. According to the company, an attacker who broke into its website stole the WebAuth key, the credential Keystone devices use to prove they are genuine. That key is written into each device during manufacturing and cannot be erased or rewritten, so Keystone says the only safe option is to scrap the stock.

The intruder also took customer order data: 25,964 records of buyers from 2024 through 2026, plus 12,873 records from checkouts that were never completed. Keystone says no recovery phrases, private keys, passwords, payment cards or bank details were exposed. Even so, this breach is unusual. Most retail breaches put customer data at risk. This one also damaged the company's ability to tell its own products apart from fakes.

How the breach unfolded

Keystone published two statements, one on Oct. 24 and one on Oct. 26. The timeline below comes from those statements as reproduced and summarized by the outlets listed in the sources.

  • Oct. 20: Keystone detected unauthorized access to its website.
  • Oct. 23: After verifying API activity with Shopify, Keystone confirmed that a third party had obtained customer shipping information.
  • Oct. 24: Keystone announced the breach publicly, said it had blocked access and fixed the vulnerability, said it was emailing affected customers, and warned that scammers might pose as the company. Per ForkLog, it also sent Shopify requests to delete expired customer data.
  • Oct. 26: A second statement said the WebAuth key had been obtained and that 18,835 unsold devices would be destroyed.

Keystone says the attacker exploited a vulnerability in a third-party data monitoring tool used by its website to escalate privileges, meaning they gained more access than the tool was supposed to have. The company has not publicly named the tool, and The Hacker News notes it has not said when the attacker first got in or where the key was stored. No source attributes the attack to any group or actor.

What was taken, and what wasn't

Keystone and secondary reporting by Cryptonomist describe the exposed order data as:

  • Names
  • Contact details
  • Shipping addresses
  • Order details and prices paid

Keystone says the following were not exposed: payment card data, bank details, government ID numbers, passwords, recovery phrases and private keys. It also says purchases made through Amazon and its other sales channels were not affected.

For a hardware wallet that last point matters most. According to ForkLog and The Hacker News, Keystone says the WebAuth key plays no part in creating recovery phrases, deriving private keys or signing transactions. On Keystone's account, a stolen WebAuth key therefore cannot be used to drain an existing wallet; the risk is to buyers who might trust a counterfeit device.

Leaked order data is still a real risk for crypto users. A list of names and home addresses of people who bought a cryptocurrency wallet tells criminals who probably holds digital assets and where they live. Cryptonomist reports that security developer Taylor Monahan warned the shipping data could expose buyers to robbery or kidnapping. Keystone's own warning points at the same danger: expect contact from people pretending to be Keystone.

Why a stolen authentication key means scrapping devices

Each Keystone device carries the WebAuth key so it can prove it is a real Keystone product and not a clone. The Hacker News describes the check: the owner scans a QR code on Keystone's verification page with the device, then enters the code the device displays. The device can only produce the correct code if it holds the key, so anyone with a copy of the key could produce the right codes, and a counterfeit device carrying it could pass.

Keystone's guidance acknowledges this directly. For a device received after Oct. 20 that carries the old key, the company said: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit." A device delivered before Oct. 20 that passes the check can be considered genuine. Because the key is written into the hardware at manufacture and cannot be changed afterward, unsold inventory carrying the old key cannot be fixed. Keystone says it will destroy those 18,835 units, and all new devices will get a new key.

ForkLog reports that Keystone has paused shipments and moved to pre-orders until devices with a new key are available. According to The Hacker News, Keystone has not reported any counterfeit devices or thefts linked to the incident.

The data that should already have been deleted

The breach also exposed a problem with how long Keystone kept data. The company had promised to delete shipping data 180 days after an order. According to The Hacker News and ForkLog, the automated bulk-deletion tool Keystone built did not work reliably, some deletions failed, and the failures were not caught in time. As a result, data from orders going back to 2024 was still held.

ForkLog and Cryptonomist also noted that Keystone's published privacy policy wording differs from its marketing promise: ForkLog says the policy counts the 180 days from a customer's last purchase rather than from each order, and several customers reported receiving breach notices more than 180 days after ordering.

Keystone is responding by cutting its retention period from 180 days to 90 days. It sent deletion requests to Shopify on Oct. 24, with completion expected by Nov. 3. The Hacker News notes that as of Oct. 27 Keystone's privacy policy still listed 180 days.

Security teams will recognize this pattern. A retention policy does not reduce risk unless something actually deletes the data and someone checks that it did. Here, by Keystone's own account, a deletion job that failed without being noticed left roughly two years of customer orders available to the intruder.

What It Means for Defenders

If you or your organization bought a Keystone wallet:

  • Expect targeted phishing. Keystone has warned that scammers may pose as the company, offering refunds, replacement devices, recalls, wallet verification or help moving crypto. Treat any email, text, call or letter that claims to come from Keystone with suspicion. No real vendor will ever need your recovery phrase. Anyone who asks for it is attempting theft.
  • Check when your device arrived. Keystone says its guidance depends on arrival date, not where the device was bought. If you received a Keystone device after Oct. 20, contact Keystone support through its official channels and hold off using it until the company confirms it is genuine.
  • Don't panic-migrate on a stranger's advice. Keystone says the WebAuth key does not touch recovery phrases, private keys or signing, that no recovery phrases or private keys were exposed, and that owners do not need to move crypto solely because of this incident. Unsolicited messages urging you to "move your funds now" are a common follow-up scam after breaches like this.
  • Assume your home address is known. Shipping addresses were among the exposed fields. People with large holdings should think about physical-security risks and avoid tying their name and address to their crypto activity in public.

If you run an online store or manage vendor risk:

  • Audit third-party tools connected to your store. The attacker's reported entry point here was a data monitoring tool tied to the website. Keep a list of every app and integration with API access to your commerce platform, cut each one back to the minimum permissions it needs, and remove the ones you no longer use.
  • Watch your platform API logs. Keystone confirmed the breach by verifying API activity with Shopify. Make sure those logs are kept long enough to be useful, and that someone is alerted when an unusual integration starts pulling bulk customer data.
  • Verify that deletion actually happens. A 180-day retention promise did not hold because the deletion tool failed and the failures went unnoticed. Schedule regular checks that confirm old records are really gone, and treat a failed deletion job as a security incident, not just an operations ticket.
  • Keep device-identity secrets away from web infrastructure. If you make hardware that proves its authenticity with a key written at the factory, a leak of that key can turn your inventory into scrap. Wherever that key is stored or handled, it should sit far from your public website and its plugins.

For CMMC and federal-contractor readers: this incident is an illustration of third-party and supply-chain risk. A single integration appears to have exposed customer data and the trust anchor for a physical product line. It is worth reviewing how your own supplier and integration inventory would hold up against a similar privilege-escalation path.

What to watch next

Keystone expects Shopify to finish deleting old data by Nov. 3, and it has said shipments will resume once devices with a new key are available. Watch for three things: whether counterfeit devices carrying the stolen key turn up anywhere, whether Keystone names the third-party tool that was exploited, and how it plans to tell buyers how to recognize devices with the new key. The Hacker News reports Keystone has not yet said how to tell which key a device carries.

Sources