Keystone said the attacker behind its Oct. 20th store breach also took the key it uses to confirm its devices are genuine. The company is destroying 18,835 wallets from inventory and says it cannot fully rule out counterfeits among some recently received units.
The attacker who breached Keystone's online store also took the key the company uses to confirm devices are genuine, the hardware wallet maker said in an update on Monday, Oct. 26th. Keystone detected the breach on Oct. 20th.
As a result, Keystone is scrapping the 18,835 wallets in its inventory that carry that key.
Why the WebAuth key matters
The WebAuth key is written into each device at the factory and cannot be changed afterward. It plays no role in creating seeds or signing transactions. In the wrong hands, however, it could let fake devices pass Keystone's own authenticity check.
New units will receive a fresh key. Until that batch is ready, website orders are on hold in favor of preorders.
What the attacker accessed
The attacker got in through a flaw in an unnamed third-party monitoring tool on Keystone's Shopify-based site. The flaw exposed 25,964 buyer records from 2024 to 2026, including names, contact info, addresses, and order details. Keystone is also counting 12,873 unpaid checkout records as a precaution.
The company says seeds, private keys, bank payment info, and government IDs are safe, and its Amazon sales were not affected.
Keystone had advertised that it wipes shipping data within 180 days. However, customers flagged over the weekend that older orders were exposed anyway, Bankless reports. Keystone has now confirmed that some tasks in its automated erasure tool failed and the company did not catch them in time, and it is cutting retention to 90 days.
Guidance for owners
Keystone says a device delivered before Oct. 20th that passes authentication is genuine. For old-key units received after that date, the company says it "cannot completely rule out the possibility that it is counterfeit," even if the check passes. Owners of such a unit should contact support for extra verification before using it.
Keystone also says it will not ask anyone to return a device, so any "recall" request is a scam, as are offers to migrate assets or verify a wallet.
Source: Bankless
Trading involves risk.
Risk Disclaimer
