Keystone Breach Exposes 25,964 Hardware Wallet Purchase Records

Keystone’s breach exposed 25,964 purchase records tied to hardware-wallet buyers, and crypto commentator @WuBlockchain said attackers obtained a WebAuth device-authentication key that could put device authenticity at risk.

The company plans to destroy 18,835 unsold devices authenticated with the key. Keystone also plans to pause orders that have not shipped while shifting future production to a secure key.

@WuBlockchain said the compromised key could let counterfeit wallets pass as genuine. A device-authentication key checks a device’s identity and is distinct from a wallet’s seed phrase or private key. The breach did not affect seed phrases, private keys or transaction signing.

Hardware wallets are physical devices designed to provide secure cryptocurrency storage. The exposure puts purchase information and product authenticity at issue, while Keystone’s planned response centers on unsold devices and pending shipments. The breach has also raised questions about the company’s online security measures.