Keystone says a website intruder stole the factory key its hardware wallets use to prove they are genuine. The company will destroy 18,835 unsold devices containing that key and has paused shipments from its website. The catch for buyers is that a counterfeit carrying the stolen key could pass the very check meant to expose it.
The October 26 disclosure separates that authentication failure from theft of a wallet’s spending secrets: Keystone says recovery phrases and private keys were not involved. For devices received after October 20 that use the old authentication key, however, a successful online check is no longer enough. The company asks owners to contact official support and wait for confirmation before using the device.
A website breach reached the device trust check
Keystone detected unusual website access on October 20, 2026. According to its investigation, the intruder exploited a vulnerability in a third-party data-monitoring tool to gain higher privileges. That access exposed customer information and the device-authentication key. Keystone says it blocked the unauthorized access that day and fixed the vulnerability; its statement does not identify the tool or explain where the key was stored.
The stolen secret is called the WebAuth key. It is written into devices during manufacturing and, Keystone says, cannot be erased or replaced. Its job is to establish that a device holds the factory authentication secret. It does not generate recovery phrases, derive wallet private keys or sign transactions.
That distinction explains both the danger and its limit. Copying the authentication key could let a fake wallet give an accepted verification response. It does not, by itself, reveal an existing owner’s signing keys. The October 26 statement describes the possibility of counterfeit devices reaching customers; it does not identify a confirmed counterfeit batch or a resulting theft of funds.
Replacing the secret in future production cannot replace it inside the stock already made. Keystone therefore says the 18,835 affected inventory units will be destroyed, newly manufactured devices will use a new key, and outstanding website orders will remain unshipped until production with that key is complete. That inventory count is not a count of wallets stolen from customers.
Buyer records remained after deletion jobs failed
A second failure concerns the data collected to sell and deliver the wallets. Keystone says its Shopify storefront held 51,083 buyer records involved in the incident. Personal information for 25,119 had already been erased before the unauthorized access. The remaining 25,964 records, covering 2024–2026, still contained names, contact details, shipping addresses and order information.
Some of those details should have disappeared under the company’s 180-day retention policy. Keystone had built an automated bulk-erasure tool because individual deletion requests were inefficient, but some jobs failed without being detected and corrected in time. The important failure was therefore not just a promise on a privacy page: the deletion process lacked reliable confirmation that the data was gone.
The response also includes 12,873 unpaid checkout records as a precaution. Those are unfinished purchases containing submitted contact and shipping details, not another count of completed sales or necessarily distinct people. Keystone says bank-payment information and government identification numbers were not involved. Its statement excludes purchase information from Amazon and other sales channels from the customer-data impact; that exclusion does not establish the authenticity of every device bought through those channels.
Keystone says it has shortened personal-data retention to 90 days and submitted overdue erasure requests on October 24. It expects completion on November 3 after Shopify’s waiting period. That is a future checkpoint, not a completed deletion verified by this article.
Delivery date changes what owners should do
- Delivered before October 20: Keystone says these devices’ authentication functionality is unaffected. A device that passes its check can be used normally under that guidance.
- Received after October 20 with the old key: contact Keystone through its official website and obtain additional authenticity confirmation before using it, even if it passes the online check. If the delivery date or key is unclear, ask support which procedure applies rather than guessing from a pass result.
- Still awaiting a website order: the announced shipping pause remains a separate issue from the security of funds already held in a genuine wallet.
Type keyst.one into the browser yourself. The official support address is support [at] keyst [dot] one. Keystone says owners do not need to transfer assets solely because of this incident, and it will not ask them to return their device. A message claiming a mandatory recall, asset migration or investigation is a reason to verify the request independently—not to ship hardware or disclose a recovery phrase.
The separate SafePal customer-data breach shows why order information deserves its own response even when wallet signing secrets were not extracted. Keystone adds another question: whether the factory test can still establish the origin of a newly received device.
The disclosure leaves two different questions for owners: whether their purchased device has a trustworthy origin, and whether exposed order details can make an impersonator sound convincing. Knowing a real order or address does not establish that the caller represents Keystone. A general website reputation check can add context about a suspicious link, but it cannot authenticate hardware or replace the manufacturer’s additional verification.
References
- Keystone. “Statement Regarding the Security Incident on Our Official Website and Customer Guidance.” October 26, 2026. Official incident statement.
- Keystone. “Device Verification.” Accessed October 28, 2026. Device-authentication page.
