Keystone Destroys 18,835 Wallets After Major Security Breach
Keystone says customer data and a production key were leaked, and nearly 19,000 unsold hardware wallets are being destroyed. The breach raises concerns about the crypto storage distribution chain.
Key Takeaways
- Keystone is destroying 18,835 unsold hardware wallets and pausing shipments after a breach on its website.
- The attack exposed customer data, order details, and possibly 12,873 unpaid checkout records.
- The leaked authentication key could let fake wallets pass checks; recovery phrases and private keys were not stolen.
Hardware wallet maker Keystone is destroying nearly 19,000 unsold devices and temporarily pausing shipments after a breach on its website. Customer data and a key that could let fake wallets pass authentication checks were leaked in the incident.
What Exactly Leaked
According to Keystone, an attacker gained access to the website on October 20 through a flaw in a third-party data monitoring tool. The company said on X on Monday that 25,964 purchase records from 2024 through 2026 were exposed. That includes names, contact details, shipping addresses, and order information. Another 12,873 unpaid checkout records may also have been affected.
The stolen key is built into the devices during production and cannot be changed. That means wallets can be verified online as genuine, which raises the risk that fake devices could get through the check. Keystone says it will destroy 18,835 unsold units. Recovery phrases, private keys, and wallet data were not stolen.
More Pressure on Hardware Wallets
The breach fits into a string of hardware wallet incidents this year. In October, Ledger reported a major attack in which tampered hardware at some resellers could be used to intercept recovery phrases during setup. Earlier this year, data leaks at shipping companies also came to light, affecting customer data from hardware wallet users at Trezor and SafePal. These incidents show how vulnerable not just the device itself, but also the distribution chain and customer data can be.
Keystone said some customer records should already have been deleted under its own 180-day rule, but an automatic deletion tool failed without the company noticing. The company admitted that mistake and says it will replace the authentication key in new devices, switch online sales to preorders, and cut its customer data retention period to 90 days.
A flaw in an order-tracking plugin also led to exposed customer data at SafePal earlier, without seed phrases or private keys being affected. That makes it clear that with hardware wallets, not only the hardware but also the web and logistics layer can be a weak spot.
What Users Need to Know Now
Keystone says devices delivered before October 20 remain safe if they pass authentication. Customers who received a device with the old key after that date should check it extra carefully before using it. The company stresses that users do not need to move their funds just because of this breach, and warns about fake messages about recalls or moving assets.
