Keystone breach deepens: Hackers stole key used to verify wallets as genuine
Keystone initially disclosed a leak of customer information but has since disclosed that hackers also stole a key that could allow counterfeit wallets to pass authenticity checks.
Hardware wallet maker Keystone said an attacker who breached its website last week also stole a key used to verify the authenticity of its devices, widening the scope of an incident initially disclosed as a customer data leak.
In a statement Monday, Keystone said the stolen authentication key could allow attackers to produce counterfeit wallets that pass its authenticity checks.
“These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” Keystone said.
The incident adds to a series of attacks targeting hardware wallet manufacturers this year.
Earlier this month, Ledger asked resellers across Southeast Asia and Hong Kong to suspend sales following reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases.
In late July, Coldcard manufacturer Coinkite issued a warning to users after attackers exploited a bug that caused its devices to generate wallet seeds with less entropy than intended, resulting in the theft of millions of dollars in crypto.
In its latest update, Keystone said the attacker exploited a vulnerability in a third-party monitoring tool used by its website to escalate privileges.
“This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices.”
Keystone said it plans to destroy 18,835 devices in its inventory that contain the compromised key and has suspended production shipments of all devices using it.
The company said shipments would resume once it begins producing devices with a new authentication key.
Keystone said devices manufactured and delivered before the Oct. 20 incident should be considered safe and that their authenticity checks remain trustworthy.
However, it could not guarantee the authenticity of devices delivered after that date and urged affected customers to contact its support team for additional verification.
Keystone also disclosed the extent of the customer data breach, saying its website’s Shopify store had generated 51,083 buyer records.
Of those, 25,119 had been deleted per its 180-day data retention policy.
However, the remaining 25,964 records dating from 2024 to 2026 were stolen by the attacker. Keystone said the older entries were not deleted due to a failure in its automated tool used to handle bulk erasure of data.
“The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period,” Keystone said.