Keystone announced on Monday (26) that it will destroy 18,835 physical cryptocurrency wallets held in stock, after discovering that an attacker stole the digital key used to verify the authenticity of the devices. The manufacturer also suspended the shipping of pending orders and confirmed the exposure of buyers' personal information.
The attack was detected on October 20, when monitoring systems identified unauthorized access to the company's official website. According to Keystone, the attackers exploited a vulnerability in a third-party tool to escalate their access privileges and obtain the WebAuth authentication key.
This key is written to the devices during manufacturing and cannot be erased or replaced later. Although it is not involved in generating recovery phrases, creating private keys or signing transactions, it allows verifying whether a wallet is genuine.
With the stolen key, criminals could manufacture counterfeit devices capable of passing Keystone's official verification. A buyer could thus believe they had received a legitimate device and end up exposing their crypto assets. The company did not confirm the identification of counterfeit units produced with the compromised key.
To eliminate this risk in new products, the manufacturer decided to discard all stock associated with the old key. Production will use a replacement credential, while sales through the website will operate on a pre-order basis, with no confirmed date for resuming shipments.
Keystone stated that recovery phrases, private keys and wallet credentials were not compromised. Devices received before October 20 continue to be considered legitimate if they have passed authentication. Customers who received units with the old key after that date should contact support for additional verification, even if the usual test indicates authenticity.
Data deletion failure expanded the leak
The investigation also revealed problems in the storage of personal information. Of the 51,083 purchase records examined in the store operated by Shopify, 25,964 still contained customer data, including names, contacts, delivery addresses and details of orders placed between 2024 and 2026.
Another 12,873 incomplete purchase records also contained personal information.
The problem exposed a failure in a previous promise by the manufacturer. Keystone claimed to delete shipping information after 180 days, but acknowledged that its automated deletion tool had errors that were not identified in time. As a result, certain records remained stored beyond the expected period.
The company took responsibility for the failure and reduced the data retention period from 180 to 90 days. It also requested that Shopify delete the old records, with completion expected by November 3.
In addition to individually informing affected customers, Keystone warned of possible fraud attempts involving fake device return requests, wallet migration or asset verification. The manufacturer clarified that it is not conducting a device recall and that users do not need to transfer their crypto assets solely because of the incident.
