Keystone to Destroy 18,835 Wallets After Device Key Theft

Keystone said an attacker reached its website on 20 October and came away with the key its hardware wallets use to prove they are genuine. That key is written into devices during production and cannot be changed afterwards. So the company is destroying 18,835 unshipped units built with it, and shipping is suspended until a replacement key is in place. Recovery phrases, private keys and wallet credentials were not exposed, Keystone said in all three accounts read here. Customer records were: names, contact details, shipping addresses and order details for purchases going back to 2024.

What the stolen key can and cannot do

A hardware wallet holds the secret that controls someone's coins on a device that never goes online. The authentication key is a separate thing. It lets a unit pass the online check that tells a buyer the device came from the factory and not from someone in between. A counterfeit carrying that key could clear the same check. Nothing in it reaches a seed phrase. CoinDesk, which published the fullest account at 07:13 ET on Tuesday, set out the mechanics that way, and Protos quoted Keystone calling the item "the WebAuth key we use to verify whether a device is genuine".

Keystone drew its line at 20 October. Units delivered before that date are treated as safe if they pass authentication, and anything received afterwards still carrying the old key should be checked before use. Buyers in that position are routed to support, which only Parameter reports. Keystone also warned about people posing as its staff and offering refunds, replacements or fixes, and said the breach by itself is no reason to move funds. The same warning ran this month when Ledger told buyers at one reseller to leave their devices unopened.

Two accounts of when it was said

The disclosure timeline does not line up. Protos dates Keystone's first post to 24 October, an apology on X, and puts the admission about the verification key in a later update it does not date. CoinDesk and Parameter both place the announcement on Monday. The two may be one sequence counted differently, and no account read here says so. We could not establish which post carried the key admission. Keystone's statements reach this desk only as quotations inside those three reports.

The deletion that did not run

Keystone had promised to erase shipping data 180 days after an order. The automated tool meant to do it failed and the company did not notice, which is how records from 2024 were still there to take. CoinDesk puts the retained set at 25,964 buyer records covering 2024 to 2026, with 12,873 unpaid checkout records also in scope. Protos rounds those to almost 26,000 and 13,000. Parameter alone supplies a denominator, 51,083 storefront records of which 25,119 had been purged as intended. Those two figures add to 51,083, a check this desk did rather than the outlet, and neither number appears in a second account.

"We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure," Keystone said.

Where the remedy is unclear

The fix for the data problem is described two ways. CoinDesk says retention is being cut to 90 days. Parameter says Keystone asked Shopify to delete personal information from checkout records older than 30 days. A standing policy and a one-off purge are different things, neither outlet mentions the other's number, and they do not reconcile.

No funds or seeds are reported lost in any account. What the breach leaves behind is a mailing list in somebody else's hands, and the recent run of trouble at wallet makers has been phishing more often than theft. A day before Keystone's post, Foundation counted more than 23,000 phishing attempts against its customers and said it found no evidence that Passport devices or private keys were compromised. In September phishing mail reached Trezor users from Trezor's own domain. Whether a device built with the stolen Keystone key ever surfaces is the question the company cannot answer for itself, and none of the three accounts reports one yet.