Keystone to destroy 18,835 hardware wallets after attacker steals device authenticity key

Hardware wallets are sold on a simple promise: the device in your hand is the device the manufacturer built, untouched by anyone in between. Buyers are told to confirm that promise by visiting the maker's website, scanning a QR code and checking that the code the screen returns matches. For Keystone, the maker of air-gapped crypto wallets, that ritual broke down in October 2026, when an intruder walked off with the very key the check depends on.

Keystone disclosed the incident on October 26, 2026. An attacker who gained access to the company's website obtained the WebAuth key its hardware wallets use to prove they are genuine, the company said. The consequences are unusually physical for a software-era breach: 18,835 unsold devices carrying the compromised key will be destroyed, shipments are paused, and production has moved to a replacement key.

The intrusion was detected on October 20, 2026, according to Keystone, which says it blocked the attacker and fixed the flaw. That flaw sat in a third-party data monitoring tool used by its website and allowed privilege escalation, opening the way to both customer records and the authentication key. Keystone has not said when the attacker first got in or where the key was stored.

The disclosure arrived in stages. An initial statement on October 24, 2026 confirmed only that shipping information had been taken. The theft of the device authentication key surfaced in a fuller report a day later, turning a familiar e-commerce data breach into something closer to a supply chain problem.

Key Facts

The Hacker News reported on October 27 that the stolen key does not touch the parts of a wallet most owners worry about. It plays no role in creating recovery phrases, deriving private keys or signing transactions. It is written into each device during manufacturing and held in single-write memory that cannot be erased or rewritten, which is precisely why existing hardware cannot be migrated to a new key. The company must scrap inventory instead.

The verification mechanism itself is straightforward. An owner scans a QR code on Keystone's verification page with the device and enters the code the screen displays. In Keystone's open-source firmware, that QR code carries the code in encrypted form, and the device decrypts it using its stored key. A correct result proves the device holds the key. Someone else holding the same key could build counterfeit units that pass the same test, which is the risk Keystone is trying to close.

crypto.news reported on October 26 that the data exposure runs alongside the key theft. Keystone confirmed 25,964 customer records were exposed, containing names, contact information, shipping addresses and order details for purchases made between 2024 and 2026. The investigation identified 51,083 purchase records on the official Shopify store, of which personal information in 25,119 had already been erased before the attack. A further 12,873 incomplete checkout records held details from customers who never completed payment.

The records survived because a deletion process failed quietly. Keystone's automated bulk-deletion tool, built to work around Shopify's manual deletion process, did not remove some records within the company's own 180-day retention window, and the failures were not caught in time. Keystone has cut retention to 90 days and filed Shopify deletion requests on October 24. Shopify requires a 10-day waiting period, with deletion expected by November 3, 2026. Reports were filed with regulators and law enforcement in the EU, UK and other jurisdictions.

Blockhead reported on October 27 that the attacker used a vulnerability in the third-party data monitoring tool to escalate privileges, reaching buyer records in the Shopify store and the WebAuth key behind the device authentication page. Amazon and other sales channels were not affected. Keystone said it will not ask customers to return devices, and warned that any recall, refund or wallet migration message should be treated as a scam.

Analysis

What this really means is that the trust anchor for an entire product line lived in the same place as a marketing website's analytics stack. A key whose whole purpose is to prove that a physical object is authentic was reachable through a flaw in an add-on tool. That is not a failure of cryptography. It is a failure of where the cryptography was kept, and of who could reach it.

Protos reported on October 26 that the confirmation followed a customer report of a social engineering call in which genuine Keystone order information was used. Keystone had previously promised that shipping data would be permanently deleted 180 days after an order, yet the user who first flagged the breach said their device was purchased in 2024. The retention promise and the retention reality had already diverged before the attacker arrived.

The bigger picture here is that hardware wallet security has quietly shifted from the device to the vendor's back office. The device may be air-gapped, its firmware open source, its keys generated offline, and none of that matters if the company's order database and verification key sit behind a third-party tool with excessive privileges. Keystone is the second hardware wallet maker in three months to leak customer shipping data through an add-on to its online store. SafePal disclosed on August 16, 2026 that an authorization flaw in an order-tracking plug-in exposed names, emails, shipping addresses and phone numbers of roughly 39,798 customers.

The historical pattern is not encouraging. Ledger's 2020 e-commerce breach ended with roughly 272,000 customers' names, postal addresses and phone numbers dumped online, fuelling years of phishing and home threats. Protos noted that Ledger's reseller-related spyware scandal and Coldcard's seed-generation bug together produced over $200 million in losses in 2026. Each incident erodes the assumption that self-custody removes counterparty risk. It does not. It relocates that risk to the vendor, the plug-in and the deletion schedule.

Why It Matters

For owners, the practical guidance splits by delivery date. Devices delivered before October 20 that pass the verification check can be used normally, according to Keystone. Devices received after October 20 carrying the old key should not be used until support at [email protected] confirms authenticity. The company's own warning is blunt: even if such a device passes authentication, it cannot completely rule out that it is counterfeit. No counterfeit devices or thefts have been reported.

For the market, the episode tests whether buyers accept destruction of inventory as a credible response. Destroying 18,835 units is expensive and visible, and it is a stronger signal than a firmware patch. But the company still cannot recall what it already shipped. The stolen key does not let an attacker take funds directly, and recovery phrases and private keys were not compromised. The danger is downstream: a counterfeit that passes the check, sold to a buyer who then sends crypto to an address the attacker controls.

There is a data side that will outlast the hardware story. Nearly 26,000 people now know that information they were told would be deleted was still sitting in a Shopify store, along with roughly 13,000 abandoned checkout records. That is a ready-made targeting list for the refund and replacement scams Keystone is already warning about. The same week, Foundation confirmed phishing emails sent from its official domain for Passport users, traced to one or more compromised API keys on Cloudflare, with over 20,000 phishing attempts delivered.

Next Up

Shipping remains paused, and the Keystone 3 Pro was listed as a pre-order shipping in 4 to 6 weeks. New devices will carry a new key. Shopify deletion is expected by November 3, 2026, and regulatory and law enforcement filings in the EU, UK and other jurisdictions are in progress. Keystone has not explained when the attacker first gained access or where the key was stored, and those two answers will shape how much of the incident is treated as an e-commerce breach and how much as a device trust problem.

The harder question is structural. If a single authentication key can only be written once and can never be rotated, then every future compromise of that key costs a company its entire unsold inventory. Expect buyers to keep asking vendors where verification keys live, who can reach them, and whether a device can survive a key rotation at all.