Keystone has expanded its disclosure of a website breach, saying hackers stole not only customer information but also a cryptographic key used to verify whether its hardware wallets are genuine. The company warned that counterfeit devices carrying the compromised key could pass its authenticity checks and potentially expose customers’ crypto assets.
According to Cointelegraph, Keystone said the attacker obtained the key after exploiting a vulnerability in a third-party monitoring tool used by the company’s website. The breach allowed the attacker to escalate privileges and gain access to some customer information as well as the authentication key.
Counterfeit devices could pass authenticity checks
Hardware wallets are physical devices designed to hold and manage the private keys used to access cryptocurrency. An authenticity check is intended to help confirm that a device is an official product rather than a counterfeit or tampered unit.
Keystone said the stolen key could allow attackers to manufacture counterfeit wallets that appear legitimate during this verification process. Such devices could then be sold or shipped to customers, who might use them believing they had received genuine Keystone products. The company said that could create a path to asset theft.
Keystone said devices manufactured and delivered before the Oct. 20 incident should be regarded as safe, and that their authenticity checks remain reliable. It could not guarantee the authenticity of devices delivered after that date, however, and asked affected customers to contact its support team for additional checks.
The company said it has suspended production shipments of all devices that use the compromised key. It plans to destroy 18,835 units in its inventory containing that key. Shipments are expected to resume once Keystone starts manufacturing devices with a replacement authentication key.
Customer records also exposed
The company’s latest update also provided more detail about the information breach. Keystone said its Shopify store had generated 51,083 buyer records. Of those, 25,119 had been deleted under the company’s 180-day data-retention policy, while 25,964 records dating from 2024 to 2026 remained potentially accessible to the attacker.
Keystone attributed the retention problem to a failure in its automated bulk-erasure tool. Some deletion tasks did not work reliably, and the company said it failed to detect and correct those failures promptly. As a result, certain personal information was kept beyond the permitted retention period.
The attacker may also have been able to access 12,873 checkout records retained by Shopify. These records related to purchases that were started but not completed. Keystone said it had asked Shopify to delete personal information in checkout records that had been held for more than 30 days.
The company’s initial disclosure focused on the leak of customer information. The revelation that an authentication key was also stolen broadens the incident from a data-security problem to a product-authenticity concern, because customers receiving affected devices may not be able to rely solely on the normal verification process.
Wider security pressure on wallet makers
The Keystone incident comes amid several security incidents involving hardware-wallet companies this year. Earlier in October, Ledger asked resellers in Southeast Asia and Hong Kong to pause sales after reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases.
In late July, Coinkite, the manufacturer of Coldcard wallets, warned users after attackers exploited a software bug that caused devices to generate wallet seeds with less entropy than intended. The resulting thefts involved millions of dollars in cryptocurrency.
Customer-data incidents have also affected other manufacturers. Trezor reported in August that a breach at its shipping partner exposed customer information, with the number of affected users later rising above 80,000. SafePal disclosed an order-tracking vulnerability in August involving data from nearly 40,000 customers, while BitBox was targeted in a September phishing campaign linked to a compromised third-party email provider.
The broader consequences of wallet-company breaches can extend beyond the original intrusion. A June 2020 Ledger breach exposed more than 1 million email addresses, along with customer names, phone numbers and physical addresses. The information was subsequently used in phishing attempts over several years.
Moneyiar market picture
Moneyiar market data recorded on Oct. 25, 2026, at the stated times showed mixed performance among the selected crypto assets:
- Celestia (TIA): $0.5321576029, unchanged over 24 hours and down 11.85% over seven days.
- Ethereum Name Service (ENS): $5.2749448818, down 0.45% over 24 hours and 2.02% over seven days.
- Four (FORM): $0.2210079715, up 0.66% over 24 hours and down 7.29% over seven days.
- DeepBook Protocol (DEEP): $0.0164056385, down 1.11% over 24 hours and 14.74% over seven days.
These figures are Moneyiar data and are separate from Keystone’s security disclosures.
