Cryptocurrency hardware wallet manufacturer Keystone has announced plans to destroy 18,835 unsold devices after discovering that attackers obtained an authentication key used to verify whether its wallets are genuine.
The decision follows an October 20, 2026 security breach involving Keystone’s online store, initially disclosed as an incident affecting customer names, contact information, shipping addresses and purchase details. In an expanded investigation update on October 26, the company confirmed that the attackers also accessed its WebAuth device-authentication key.
The compromised credential could potentially allow counterfeit hardware wallets to pass Keystone’s official authenticity verification process, creating risks for customers purchasing devices through unauthorized channels. Keystone has suspended shipments of unfulfilled website orders and moved to a preorder model while preparing replacement devices.
The company emphasized that cryptocurrency recovery phrases, private keys, passwords and payment information were not compromised.
Stolen Authentication Key Forces Inventory Destruction
According to Keystone, the attackers exploited a vulnerability in a third-party data-monitoring tool connected to its website, allowing them to escalate privileges and access sensitive information. Among the exposed assets was the WebAuth key embedded in hardware wallets during manufacturing.
The credential is used to authenticate devices through Keystone’s official verification website. Because the key cannot be erased or rewritten after manufacturing, devices containing it cannot be updated to use a replacement credential.
Keystone therefore plans to destroy all 18,835 affected devices currently held in inventory rather than distribute products whose authenticity could become difficult to establish. Future production will use a newly generated authentication key.
The company explained that the compromised credential does not generate recovery phrases, derive private keys or authorize cryptocurrency transactions. However, attackers possessing the key could potentially manufacture counterfeit devices that appear legitimate during authentication.
Such devices could expose customers to asset theft if malicious hardware were substituted during distribution. Keystone said wallets received and authenticated before October 20 remain safe to use. Customers who received devices containing the older key after that date have been advised to contact official support for additional verification.
The company stressed that it is not conducting a physical device recall and will not ask customers to return existing wallets.
Nearly 39,000 Purchase and Checkout Records Exposed
The expanded investigation also established the scale of the customer-information breach. Keystone identified 51,083 historical buyer records in its Shopify-powered store, covering purchases between 2024 and 2026.
Personal information associated with 25,119 records had already been erased or anonymized before the intrusion. However, another 25,964 purchase records still contained identifiable customer information. Investigators also discovered 12,873 incomplete checkout records containing names, contact details and shipping information.
Together, the findings identify 38,837 potentially exposed purchase and checkout records, although this does not necessarily represent the same number of unique individuals. Keystone acknowledged that its automated data-deletion system had failed to consistently enforce its advertised 180-day retention policy.
Some deletion requests failed without being detected, leaving information accessible longer than intended. The company has shortened its customer-data retention period to 90 days and submitted deletion requests for overdue records.
Under Shopify’s processing timetable, those requests were expected to be completed by November 3. Keystone also plans to notify affected customers individually and introduce a service allowing users to check whether their information was exposed.
The company said regulatory and law-enforcement notifications had been submitted in relevant jurisdictions, including the European Union and United Kingdom. The incident illustrates two distinct risks facing cryptocurrency hardware wallet manufacturers: exposure of personal information and compromise of the infrastructure used to authenticate physical devices.
Although Keystone has not reported theft of customer cryptocurrency, the stolen authentication credential raises concerns about counterfeit devices and supply-chain security. The manufacturer’s immediate priorities are replacing compromised inventory, restoring shipments and demonstrating that its authentication and customer-data systems have been secured.
