Keystone Breach Deepens: Hackers Stole Key Used to Verify Wallets as Genuine

Keystone, a maker of hardware cryptocurrency wallets, disclosed on Monday that a cyberattack on its systems was significantly more serious than first reported, with the attacker having obtained an authentication key capable of making counterfeit wallets indistinguishable from genuine products.

The company said the attacker exploited a vulnerability in a third-party monitoring tool embedded in Keystone's website. That flaw allowed the intruder to escalate privileges and gain access to both customer data and the authentication key Keystone uses to certify that a physical device is a legitimate product.

In a statement, Keystone warned that the stolen key could enable bad actors to produce or modify wallets that would pass authenticity checks. "These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products," the company said. The risk to end users is significant: a tampered wallet that clears authenticity checks could expose private keys and drain funds without the owner's knowledge.

In response, Keystone said it is destroying 18,835 devices that contain the compromised authentication key and has suspended production shipments while a replacement key is developed and implemented. The company said devices manufactured and delivered before October 20 are not affected and can be considered safe.

The customer data dimension of the breach also worsened upon closer examination. Keystone said 25,964 buyer records collected between 2024 and 2026 were stolen — records that should have been purged under the company's 180-day data retention policy. An automated deletion tool had failed and those failures went undetected. An additional 12,873 incomplete checkout records were also compromised through its Shopify integration.

The dual nature of the breach — combining a supply-chain authentication risk with a mass customer data exposure — puts Keystone in particularly difficult territory. Hardware wallet makers occupy a uniquely sensitive position in the crypto ecosystem: their products are often chosen precisely because users do not trust software or exchange-based custody. A compromised device-verification system strikes at the core of that value proposition.

The incident is not isolated. The hardware wallet industry has faced an unusually turbulent 2026, with Ledger reporting implant-based compromises affecting devices in Southeast Asia, Coldcard disclosing an entropy bug, Trezor implicating a shipping partner, SafePal identifying a tracking vulnerability, and BitBox warning customers of a targeted phishing campaign. The pattern points to a sustained and coordinated interest from threat actors in subverting physical crypto security devices.

Security researchers have long flagged supply-chain attacks as the most dangerous vector for hardware wallet compromise, since a device that passes authenticity checks grants an attacker the full trust of both the firmware and the user. The theft of a signing or attestation key represents a worst-case version of that scenario.

Keystone said it will resume shipments once the new authentication infrastructure is in place, but did not provide a specific timeline. Customers who purchased devices have been advised to verify delivery dates against the October 20 cutoff and to treat any unsolicited or unexpected devices with extreme caution until further guidance is issued.

The broader message from the incident is that hardware wallet security is only as strong as the weakest link in the chain — including the monitoring and operations tools that manufacturers rely on to run their businesses. Third-party software embedded in vendor systems has proven an increasingly attractive entry point for attackers targeting high-value supply chains across multiple industries.