Keystone Will Destroy 18,835 Wallets After Authentication Key Theft

Keystone says it will destroy 18,835 hardware wallets in its inventory that contain a compromised authentication key. It has paused shipments of devices using that key. The stolen key could let counterfeit wallets pass Keystone’s authenticity checks.

Keystone said the attacker used a flaw in a third-party monitoring tool on its website to gain higher access. Its store had created 51,083 buyer records and deleted 25,119 under its 180-day data retention policy. The remaining 25,964 records, dating from 2024 through 2026, may have been stolen after an automated deletion tool failed. Shopify held 12,873 checkout records for purchases that were never completed; the attacker may have accessed those as well.

Keystone considers devices made and delivered before Oct. 20 safe, but cannot guarantee devices delivered after that date. It has asked affected customers to contact support for additional verification. Shipments will resume once Keystone begins producing devices with a replacement key.