Keystone, a manufacturer of cryptocurrency hardware wallets, announced a major security breach that compromised not just customer data but also a crucial authentication key used to verify the legitimacy of its wallets. The incident, first reported as a customer data leak, now raises serious concerns over the risk of counterfeit devices entering the market.
Keystone warns of fake device risk
The company stated that hackers who recently breached its website also stole an authentication key that underpins device legitimacy checks. This key is essential for confirming that a hardware wallet is genuine during setup and verification.
“These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” Keystone stated.
Following the breach, Keystone announced it will destroy 18,835 devices in its current inventory that rely on the compromised key. The company has also halted shipments of these devices and will only resume sales once a new authentication system is in place.
Deliveries of updated devices will begin once the company completes the implementation of a new, secure authentication protocol. Keystone has urged customers with products delivered after October 20 to contact its support team for additional verification, while devices shipped before this date are considered safe.
Breach details and customer data exposure
Keystone explained that the attacker exploited a vulnerability in a third-party monitoring tool installed on its website. This flaw allowed unauthorized escalation of privileges, giving the attacker access to systems secured by the authentication key.
This security weakness enabled the attacker to access both sensitive customer information and the hardware device authentication key.
The breach also impacted the company’s Shopify store records. Keystone reported it had created 51,083 buyer records since launching on Shopify. Of these, 25,119 were previously deleted in line with the company’s 180-day data retention policy.
However, 25,964 records, dated between 2024 and 2026, remained on the system due to a failure in the deletion tool. As a result, these records may have been compromised in the attack.
Additional risks arose from 12,873 incomplete checkout records stored by Shopify, some of which could contain personal information. Keystone requested Shopify to remove any personal data stored for over 30 days from these incomplete transactions.
Mini dictionary: Shopify, a widely used e-commerce platform, provides solutions for online stores and retail point-of-sale systems, enabling businesses to manage sales, payments, and shipping.
| Record type | Number of records | Status |
|---|---|---|
| Buyer records created | 51,083 | All-time |
| Buyer records deleted | 25,119 | Per retention policy |
| Buyer records potentially exposed | 25,964 | 2024-2026, deletion tool failed |
| Incomplete checkout records | 12,873 | May include personal data |
String of attacks on hardware wallet providers
The Keystone breach highlights ongoing vulnerabilities in the hardware wallet industry. Earlier this month, Ledger, another hardware wallet maker, paused sales in Southeast Asia and Hong Kong following reports that unauthorized implants had been discovered in devices, compromising recovery phrases.
In July, Coinkite, maker of the Coldcard wallet, reported that a software bug had weakened wallet seed randomness, enabling attackers to steal millions in cryptocurrency. In August, Trezor, a major competitor, acknowledged a breach at its shipping partner affecting more than 80,000 users. SafePal and BitBox faced their own data exposures in incidents tied to faulty third-party systems.
The latest attack on Keystone draws comparisons to a significant Ledger breach in June 2020, which leaked over 1 million email addresses and extensive personal information, fueling widespread phishing campaigns for years to follow.
Keystone has assured users that devices produced and shipped prior to October 20 remain reliable. However, the security of devices delivered after this date cannot be guaranteed, and affected customers are encouraged to seek support for further assurance.
