Keystone Wallet to Destroy 18,835 Devices After Security Breach Exposes Key

Keystone Wallet, a manufacturer of crypto hardware wallets, has announced the destruction of 18,835 unsold devices after a security breach exposed a critical authentication key. The breach was detected on October 20, 2026, when attackers exploited a vulnerability in a third-party data monitoring tool used by the company's website.

The investigation revealed that the attackers were able to escalate privileges and access customer information, including 25,964 records containing personal details such as names, contact information, shipping addresses, and order data from 2024 to 2026. Additionally, 12,873 unpaid checkout records and the WebAuth key for device verification were compromised. However, no recovery phrases, private keys, or payment information were affected.

The exposed key, which is embedded in devices during manufacturing and cannot be erased or rewritten, poses a significant risk. It could allow counterfeit wallets to be created that would pass authenticity checks, potentially leading to asset theft for users. In response to the breach, Keystone Wallet is halting production using the old key, destroying the affected inventory, and suspending shipments of unshipped orders. They are transitioning to a preorder model for new devices that will incorporate a fresh key.

Furthermore, the company has reduced its data retention period from 180 days to 90 days, submitted erasure requests to Shopify, and reported the incident to regulators in the EU and UK. Devices shipped before the breach date remain valid if they pass authentication checks. Keystone Wallet has also warned users to be cautious of scams related to asset migration or wallet verification.