Keystone initially reported a customer data leak, but further disclosure revealed that hackers stole a cryptographic key, allowing counterfeit wallets to pass authenticity checks.
Hardware wallet manufacturer Keystone acknowledged that a recent website breach exposed more than customer data, as the intruder also compromised a device verification key that allows counterfeit hardware to bypass authenticity checks.
On Monday, Keystone confirmed that the compromised authentication key could enable attackers to manufacture fake wallets designed to bypass official verification checks.
“These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,”
Keystone said.
This breach marks another entry in a growing wave of cyberattacks aimed at hardware wallet vendors throughout the year.
Earlier this month, Ledger instructed regional distributors across Southeast Asia and Hong Kong to halt sales after reports surfaced that compromised units shipped with unauthorized implants designed to intercept recovery phrases.
Late last July, Coldcard maker Coinkite alerted users after hackers exploited a flaw that forced devices to produce weaker wallet seeds, leaving millions of dollars in crypto vulnerable to theft.
Keystone to Destroy Over 18,000 Devices Linked to Old Security Key
In a recent update, Keystone explained that the intruder leveraged a security flaw within a third-party website monitoring tool to gain elevated permissions.
“This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices.”
Keystone announced plans to scrap 18,835 inventory devices carrying the compromised key while halting outgoing shipments of all products reliant on it.
Keystone outlined steps to destroy 18,835 warehouse units embedded with the compromised key while pausing incoming shipments for all models built around it.
Keystone confirmed that units produced and shipped prior to the Oct. 20 breach remain safe, with their security verification processes left fully intact.
However, the company could not ensure the legitimacy of units received after that date, prompting affected buyers to reach out to customer support for extra verification.
Keystone Confirms Data Leak Exposing 25,964 Customer Records
Additionally, Keystone revealed the full scale of the customer breach, noting that 51,083 buyer profiles had been compiled by its Shopify store.
Out of that total, 25,119 records were purged under the corporate 180-day retention guidelines.
Yet, the intruder may have compromised the remaining 25,964 files spanning from 2024 to 2026. Keystone clarified that these legacy logs weren’t scrubbed because an automated bulk-deletion script malfunctioned.
“The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period,” Keystone said.
Additionally, the intruder may have accessed 12,873 abandoned checkout logs maintained by Shopify, covering customer purchases that remained unfinished.
Keystone reached out to Shopify, requesting that personal details within checkout logs older than thirty days be cleared out.
This event mirrors a June 2020 security breach at Ledger, where over a million email addresses—plus names, phone numbers, and home locations—were leaked. Consequently, those exposed details drove years of targeted phishing attacks against victims.
This year, competing hardware wallet brands have likewise endured security breaches connected to customer records and external vendor services.
Last August, Trezor revealed a logistics vendor breach that exposed buyer details, before the total count of impacted users swelled beyond 80,000 come September.
In August, SafePal revealed an order-tracking flaw that leaked records for nearly 40,000 buyers, while BitBox faced a September phishing scheme stemming from a breached third-party email vendor.
