Keystone Data Breach Exposes Security Key for Hardware Wallets

Keystone hackers steal verification key for hardware devices

Hardware wallet maker Keystone has revealed that a recent website breach resulted in the theft of a security key. This key is used to verify that its hardware wallets—physical devices used to store cryptocurrency offline—are genuine.

The company stated that the breach, which occurred last week, is more serious than the customer data leak it first reported. The stolen key could allow attackers to create fake wallets that appear official. Customers who unknowingly use these counterfeit products could have their digital assets stolen.

Key numbers from the security incident

• 25,964 buyer records from 2024 to 2026 were stolen.
• 12,873 incomplete checkout records were also taken.
• 18,835 devices currently in inventory will be destroyed to ensure safety.

How the security breach occurred

Keystone said an attacker exploited a vulnerability in a third-party tool used for monitoring its website. This allowed the hacker to gain higher access levels and steal both customer information and the authentication key. The company also admitted that an automated tool failed to delete older customer data as required by its internal policies, leaving those records exposed.

Wider context of hardware wallet security risks

This incident follows other security issues involving wallet manufacturers this year. Ledger recently asked some resellers to stop sales after reports of unauthorized implants in devices. In July, Coinkite warned users about a bug that weakened the security of generated wallet seeds, leading to the theft of millions of dollars in crypto. Other companies like Trezor and SafePal have also reported customer data leaks involving third-party partners.

Confirmed facts about the leak

Keystone has confirmed that the stolen data includes names and addresses of customers who purchased wallets between 2024 and 2026. The hackers also accessed checkout information for people who started a purchase but did not finish it. Devices delivered before October 20 are considered safe, as the company believes their authenticity checks remain trustworthy.

Uncertainty for recent buyers

Keystone stated it cannot guarantee the authenticity of any devices delivered after October 20. The company has urged customers who received devices after that date to contact their support team for additional verification.

Why this matters for crypto users

The theft of a verification key is a significant security risk because it undermines the trust users place in hardware wallets. If a counterfeit device is used, an attacker could have direct access to the user's funds. Additionally, the leak of personal information is often used by scammers to launch phishing attacks, where they attempt to trick users into revealing their private security phrases.

Next steps for Keystone and customers

The company has suspended all shipments of hardware wallets that use the compromised key. It will only resume shipping once new devices are produced using a new authentication key. Keystone has also asked its website partner, Shopify, to delete personal information held in checkout records for more than 30 days.

Sources

• Cointelegraph