Keystone, a manufacturer of hardware wallets for storing cryptocurrency offline, is destroying 18,835 unsold devices and has paused shipments after an attacker obtained the permanent factory key used to verify that its products are genuine.
The breach creates a specific counterfeit risk: a fake wallet could be made to pass Keystone’s own authentication check. A customer might then believe the device was authentic, transfer cryptocurrency to it and expose the secret credentials controlling those assets. According to Decrypt, the company detected the incident on October 20 and has suspended shipment of all unfulfilled orders placed through its website.
Keystone says the incident did not involve customers’ recovery phrases or private keys. It also says devices delivered before October 20 are unaffected. However, the company is treating unsold inventory carrying the compromised key as unsafe to distribute rather than attempting to sell or ship those units.
Why the stolen key matters
Hardware wallets are physical devices designed to keep the private keys used to control crypto assets offline. Keystone’s products contain a permanent WebAuth key placed on each device during manufacturing. The company’s website can use that key to confirm that a wallet is an authentic Keystone product.
Because the key cannot be erased or rewritten, its exposure means an attacker could use it to manufacture counterfeit devices that pass the same verification process. Keystone warned that such products could be sold or delivered to customers who believe they are receiving genuine hardware. The company said the potential consequence could be theft of assets placed on those counterfeit devices.
Keystone has not identified who obtained the key or said when the attacker first gained access. The company initially disclosed on Saturday that a third party had obtained customer shipping information. Its Monday statement added details about the authentication key and the number of affected records.
The manufacturer plans to replace the compromised key in future production. Sales through Keystone’s website are expected to move to a preorder model until devices using the new key are ready. It has also submitted reports to authorities in the European Union, the United Kingdom and other jurisdictions.
Customer information exposed
The incident also involved information held by Keystone’s Shopify store, the platform used to process online sales. The company said 51,083 buyer records were involved in total. Personal information had already been erased from 25,119 of those records, leaving 25,964 records from 2024 through 2026 that still contained customer details.
The remaining information included names, contact details, shipping addresses and order information. Purchases made through Amazon and other sales channels were not affected, according to Keystone.
The company said its previous policy required customer records to be erased after 180 days. An automated bulk-deletion tool used for that purpose did not work reliably, and some erasure tasks failed without being detected and corrected in time. Keystone said it accepted responsibility for retaining certain personal information beyond the permitted period.
It has now reduced its retention period from 180 days to 90 days. On October 24, Keystone asked Shopify to erase overdue buyer data. The process has a 10-day waiting period, and the company expects the deletion to be completed on November 3.
Names and addresses can create risks beyond ordinary online fraud for crypto owners. The source material notes that criminals have used so-called wrench attacks—threats or violence intended to force people to surrender cryptocurrency credentials. Chainalysis counted 46 violent attacks in the first half of 2026, involving more than $30 million in stolen assets.
The incident also follows other customer-data disclosures in the hardware-wallet sector. Ledger’s 2020 leak eventually reached about 292,000 customers, while Trezor and SafePal disclosed breaches in August affecting 13,689 and approximately 39,798 customers, respectively.
Warning about follow-up scams
Keystone said customers should be alert to messages offering “asset migration,” “wallet verification” or “investigation assistance.” It specifically warned that it will not ask customers to return their devices.
Anyone claiming to conduct a recall and asking a customer to ship a wallet back should be treated as a scammer, the company said. This warning is separate from the counterfeit-device risk: it concerns people who may exploit the incident by impersonating Keystone or offering help with affected wallets.
Moneyiar market picture
Moneyiar data at 22:39 on October 25, 2026, showed Bitcoin at $80,430.5068, down 0.08% over 24 hours and 1.32% over seven days. Ethereum Name Service was $5.2749, down 0.45% in 24 hours and 2.02% over seven days, according to Moneyiar data at 22:38.
Compound stood at $21.1287, down 10.42% over 24 hours but up 0.30% over seven days. AKEDO was $0.031016, up 0.80% over 24 hours and 2.50% over seven days, based on Moneyiar data at 22:39.
