Keystone to Destroy 18,835 Hardware Wallets After Verification Key Theft
Summary
Keystone says an attacker exploited a third-party monitoring-tool vulnerability to access customer records and its hardware-wallet authenticity key. No recovery phrases, private keys, counterfeit devices or crypto theft were reported; 18,835 unsold devices will be scr~~
Key points
- Keystone said it discovered unauthorized access on October 20 and blocked the attacker; it has not said when the attacker first gained access.
- According to Keystone, the attacker exploited a vulnerability in a third-party data monitoring tool to escalate privileges and obtain customer data and the device verification key.
- The incident affected 25,964 buyer records from 2024–2026, including names, contact details, shipping addresses and order details. Keystone also included 12,873 unpaid checkout records as a precaution.
- Keystone said payment card and bank details, government ID numbers, recovery phrases and wallet private keys were not involved. It has not reported counterfeit devices or crypto theft.
- The stolen key could let counterfeit devices pass Keystone’s online authenticity check. Keystone will destroy 18,835 unsold devices carrying the key; newly manufactured devices will use a new key.
- Keystone said an unreliable bulk-deletion tool left some customer records undeleted beyond its promised 180-day retention period. It is reducing retention to 90 days and has asked Shopify to delete older buyer data.
Article Details
- Victim Organization
- Keystone
- Incident Type
- Unauthorized access to Keystone's website through exploitation of a vulnerability in a third-party data monitoring tool, enabling access to customer data and the hardware-wallet device verification key.
- Disclosure Date
- 2026-10-24
- Data Types Exposed
- Names
- Contact details
- Shipping addresses and information
- Order details
- Hardware-wallet device verification key
- Affected Records
- 25,964 buyer records from purchases between 2024 and 2026. Keystone also included 12,873 unpaid checkout records as a precaution; these were from incomplete purchases.
- Operational Impact
- Keystone blocked the attacker's access on October 20 and fixed the vulnerability. It plans to destroy 18,835 unsold devices carrying the exposed verification key and use a new key for new devices. The key cannot be erased or rewritten on devices already manufactured. Keystone reported no counterfeit devices or thefts. Payment card details, bank details, government ID numbers, recovery phrases, and wallet private keys were not involved.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
Vendors
KeystoneAn attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.Shopifyhold names, contact details, shipping addresses, and order details. Keystone's online store runs on Shopify, which stored and managed the records.