Keystone to Destroy 18,835 Wallets After Website Intruder Obtains Authentication Key

A stolen key forces a costly reset

Keystone’s website breach has forced a costly reset of its hardware wallet supply chain: the company says it will destroy 18,835 devices in inventory after an intruder obtained the key used to verify device authenticity. In an October 26 post on X, Keystone described the response as a switch to a new manufacturing key, a halt to shipments of outstanding web orders and preorder-only sales until replacement units are ready. That means the incident affects more than the company’s website and customer records; it has interrupted the path from manufacturing to delivery for buyers who placed orders online.

The compromised WebAuth key is embedded in devices during production and cannot be removed or changed afterward. A person with a copy could use it to make counterfeit wallets that pass Keystone’s online authenticity check, potentially putting funds at risk. The company says the key does not generate recovery phrases or private keys, and plays no part in signing transactions. That distinction narrows what the stolen key can do, but it doesn’t make the authentication issue trivial: a check customers rely on to establish that a device is genuine can no longer provide the same assurance for affected units.

Destroying the devices is a significant operational cost, but the company’s stated reason is straightforward. Since the embedded key can’t be replaced, existing inventory built around it can’t be brought into line with the new key simply by changing a website setting. Keystone is choosing to scrap that stock and resume sales with devices made under the replacement key. The numbers here are substantial, and the disruption gives customers a practical reason to look closely at the company’s instructions.

Authentication checks depend on delivery date

Keystone says devices delivered before October 20—the date its monitoring system flagged unusual website access—can be trusted if they pass authentication. For devices delivered later that still use the old key, a passing check isn’t conclusive: the company said it “cannot completely rule out the possibility that it is counterfeit.” It advises those customers to contact support before using the device. The delivery date therefore changes how much confidence a customer should place in the same check, a distinction that may not be obvious to someone who assumes a successful result always means the wallet is authentic.

Here's the thing: authentication is useful only to the extent that customers can interpret its result. Keystone’s guidance places the burden on buyers with later deliveries to pause and seek help, rather than treating a pass as proof. If you're among those customers, the company’s advice is to contact support before using the device; that’s a more cautious standard than relying on the check alone.

Keystone says customers should not return their wallets. It warned that requests to send devices back as part of a “recall” are scams. That warning matters because a breach can create an opening for people to pose as the company and turn customer concern into another risk. The company’s instruction is clear: don’t send a wallet in response to an unsolicited return request.

Customer records remained past the deletion deadline

The company also detailed the data exposure it first disclosed on October 24. The intrusion involved 51,083 buyer records in its Shopify store. Data for 25,119 had already been erased; another 25,964 records, dating from 2024 to 2026, still contained names, contact information, shipping addresses and order details. Those fields can reveal who bought a product and where it was sent, even though Keystone says more sensitive wallet credentials weren’t part of the exposure.

Keystone also identified 12,873 checkout records for unpaid purchases. Those records included names and contact and shipping details, though the company cautioned that some information might have been incomplete or inaccurate. On October 24, it asked Shopify to delete personal data in checkout records older than 30 days. The inclusion of unpaid purchases broadens the group whose information may have been exposed: a person didn’t necessarily need to complete an order for a record to remain in the store.

Keystone’s stated policy called for buyer records to be erased after 180 days. But a bulk-deletion tool “did not operate reliably,” and the company says it failed to catch the unsuccessful jobs. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” it said. The breach thus exposed a gap between a written retention policy and the company’s ability to carry it out. A deletion rule has little practical effect if failed jobs go unnoticed.

The company expects the overdue-data deletion requests to be complete on November 3, following a 10-day waiting period. Its statement refers to a 90-day retention period, which it says it is adopting instead of the previous 180-day limit. Shortening the stated period may reduce how long records are kept, but the immediate issue is whether deletion now works as intended and whether failed requests are noticed. And this is the part most people overlook: retention limits depend on routine processes being monitored, not just written down.

Scope of the breach—and what comes next

Keystone traced the intrusion to a flaw in an unnamed third-party data monitoring tool on its website. It said recovery phrases, private keys, bank payment details and government ID numbers were not involved, and that it filed reports in the EU, the UK and other jurisdictions. The company’s description separates the website and customer-record incident from the wallet’s functions for generating keys and signing transactions. That’s useful context, though customers still have to weigh the stated limits of the breach against the exposed order and contact information.

This is more significant than it looks because the incident touches two different kinds of trust at once: confidence that a wallet is genuine and confidence that a company will handle customer data as promised. Keystone has outlined immediate steps—retiring the old manufacturing key, replacing affected inventory and seeking deletion of overdue records—but the public account also points to failures in website security and data-retention operations. A reset addresses the compromised key. It doesn’t, by itself, show whether the company’s monitoring and deletion processes will catch the next problem.

Keystone’s next practical test is whether it can restart web sales with new-key devices while giving customers clear guidance on wallets delivered after October 20. It’ll also need to make the revised retention period work in practice, according to its own statement. The outcome will depend on execution and on whether customers can understand which instructions apply to their device. A costly reset, and a test of the company’s follow-through.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Related Listen: Why a $100M Ledger Reseller Attack Has Crypto Rethinking Self-Custody

The post Keystone Halts Web Orders, Will Junk 18,835 Wallets in Stock Over Stolen Authenticity Key appeared first on Unchained.