Keystone to Destroy 18,835 Wallets After Authentication Key Theft

Keystone plans to destroy 18,835 hardware wallets after attackers stole a key used to verify whether its devices are genuine, Bitcoin.com News reported. The manufacturer has suspended shipments of outstanding website orders while it replaces inventory carrying the compromised authentication key.

The company disclosed the expanded scope of the breach on October 26, 2026, following suspicious website activity detected on October 20. Keystone attributed the intrusion to a vulnerability in a third-party data monitoring tool that allowed attackers to gain elevated access. It said it disabled vulnerable website functions and began a forensic investigation.

The stolen credential, known as the WebAuth key, could enable counterfeit wallets to pass Keystone’s authenticity checks. According to the company’s explanation, the key is installed during manufacturing and cannot subsequently be erased or rewritten. That makes replacing the affected inventory necessary rather than addressing the problem through a software update.

Keystone said the authentication key does not generate recovery phrases, derive private keys or sign transactions. Its exposure therefore presents a device-verification problem, distinct from the theft of credentials controlling customers’ cryptocurrency. The company nevertheless warned that counterfeit devices passing as genuine products could put buyers’ assets at risk.

Newly manufactured wallets will use a replacement authentication key, while website sales have shifted to preorders until replacement devices are ready. The destruction plan concerns existing inventory containing the old key. Keystone’s response does not amount to a general instruction for existing customers to return their wallets.

The investigation also identified personal information in 25,964 of the 51,083 buyer records examined from Keystone’s Shopify store. Exposed details included names, contact information, shipping addresses and order histories covering purchases between 2024 and 2026. Investigators separately identified 12,873 incomplete checkout records containing customer information.

Keystone acknowledged that its automated deletion process had failed to remove some information within its stated 180-day retention period. The company said it had not detected the failed deletion tasks in time. It has since shortened the retention period to 90 days and initiated additional deletion requests.

For existing owners, Keystone said recovery phrases, private keys, wallet credentials and payment information were not compromised. It is not instructing customers to move cryptocurrency solely because of the incident. Devices delivered before October 20 remain safe to use if they pass authentication, according to the company.

Customers receiving devices with the old key after that date should contact support for additional verification, even if the online authenticity check succeeds. Keystone also warned against fraudulent recall messages requesting device returns. Exposed purchase and contact details could make impersonation attempts more convincing, adding a separate concern alongside counterfeit hardware.

Keystone said it has submitted regulatory reports in the European Union, the United Kingdom and other jurisdictions, and plans further security reviews and customer lookup tools. It expected overdue buyer-data deletion requests submitted on October 24 to be finalized on November 3. Outstanding shipments remain suspended pending replacement devices.