Hackers Stole the Key That Proves a Keystone Wallet Is Real, So the Company Is Destroying 18,835 of Them

Keystone is about to shred 18,835 brand new hardware wallets. Nothing is wrong with the hardware. The problem is that an attacker walked off with the secret those devices use to prove they are genuine, and that secret is burned into every one of them for good.

The crypto wallet maker said on October 26 that someone who got into its website obtained the authentication key, which Gizmodo calls the WebAuth key. The attacker exploited a flaw in a third party data monitoring tool used by the site to escalate privileges, which opened up both customer data and the key. Keystone spotted the access on October 20, blocked it that day and fixed the flaw. It has not said when the intruder first got in, or where the key was kept.

A trust check anyone can now pass

The check works like this, as The Hacker News lays out. An owner scans a QR code on Keystone's verification page with the device, then types back the code the device displays. In Keystone's open source firmware, the QR carries that code encrypted, and the device decrypts it with the stored key. Anyone holding a copy of the key can produce the right answer, so a counterfeit carrying it could pass.

The key has nothing to do with recovery phrases, private keys or transaction signing, and Keystone says none of those were exposed. But it is written into write once memory at the factory and cannot be erased or replaced. Existing devices are stuck with it.

Hence the shredder. Keystone will destroy the unsold stock carrying the old key and give every new device a new one. Website shipping is paused, and as of October 27 the store listed the Keystone 3 Pro as a pre-order shipping in four to six weeks.

Owners who got a device before October 20 and see it pass the check can keep using it normally. Anyone who received one after that date with the old key gets a blunter message: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit." Those owners are told to contact support and wait for confirmation before using it, though Keystone has not explained how to tell which key a device carries. It says nobody needs to move funds because of the incident alone, and it has not reported any counterfeits or thefts. It also warned that any call, text, email or letter offering a refund, recall, replacement or help moving crypto is a scam, and that it will never ask for a device back.

Data that should already have been gone

The key was not the only thing taken. Keystone first disclosed the breach on October 24 as a shipping data problem. It covers 25,964 buyer records from website purchases between 2024 and 2026, with names, contact details, shipping addresses and order details stored on Shopify, plus 12,873 unpaid checkout records included as a precaution. No card, bank or ID numbers were involved, and Amazon and other channel purchases are unaffected.

Some of those records should not have existed. Keystone promised to erase customer data after 180 days, but an automated bulk erasure tool failed silently. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure," the company said. Retention is dropping to 90 days.

That matters because a list of hardware wallet buyers is a map to crypto holders' front doors, and physical assaults and kidnappings of those holders have been rising. The industry keeps getting hit, too. A day earlier Foundation disclosed attackers had sent fake recall emails from its real domains, and earlier this year a Ledger supply chain attack and a Coldcard firmware flaw were tied to more than $200 million in estimated losses. We also reported on the spy implant found inside Ledger wallets sold by a reseller. For a company selling security in a box, the root of trust turned out to be sitting on a web store.

Some offers on this page may be paid placements or contain affiliate links.