Keystone’s Auth Key Escaped: 18,835 Unsold Wallets Headed for the Scrap Heap

In a Monday statement dated October 26, 2026, hardware wallet maker Keystone said an attacker who breached its website also stole a WebAuth key used to verify the authenticity of its devices, potentially allowing counterfeit wallets to pass Keystone checks. The WebAuth key is a secret code written into each device at the factory and cannot be erased or rewritten. Keystone said it will destroy 18,835 unsold devices carrying the compromised key, has suspended production shipments and stopped shipping all unshipped website orders, and will resume once devices with a new authentication key are produced. “These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” Keystone said. The company said devices manufactured and delivered before the Oct. 20 incident should be considered safe and that their authenticity checks remain trustworthy, but it could not guarantee the authenticity of devices delivered after that date and urged affected customers to contact support for additional verification.

The company said the attacker exploited a vulnerability in a third-party monitoring tool used by its website to escalate privileges. “This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices.” Keystone’s initial Saturday disclosure said it detected suspicious activity earlier in the week and confirmed Friday, after reviewing API activity with Shopify, that an unauthorized third party had accessed customer shipping information. “We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” the company said. “Again, we’re truly sorry to everyone affected,” Keystone said.

Keystone said its Shopify store generated 51,083 buyer records. It had deleted 25,119 under its 180-day customer data retention policy, while 25,964 records dating from 2024 to 2026 may have been stolen, including names, contact details, shipping addresses and order information. The attacker may also have accessed 12,873 customer checkout records retained by Shopify for purchases that had not been completed. Keystone had said in a 2023 blog post that it reduced customer data retention to 180 days following security incidents affecting other hardware wallet manufacturers. “The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period,” Keystone said. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.” Purchases through Amazon and other channels were not affected.

Keystone warned that exposed information could be used for targeted phishing attacks, and security researcher Taylor Monahan raised concerns that leaking shipping addresses could expose customers to physical attacks and kidnappings. An X user going by “OG DEGEN” said a scammer claiming to be law enforcement investigating a fraud case referenced information from a Keystone order placed in 2024. “I think their plan was to convince me that my private keys had been exposed and then send me a phishing link to supposedly reset them,” they wrote on X. Another X user, trintaetres, also said they received a breach notification despite buying the device over two years ago. Blockchain security firm CertiK recorded 52 verified wrench attacks worldwide in the first half of 2026, up 33% from 39 during the same period last year, while Chainalysis counted 46 violent attacks in the first half of 2026, with more than $30 million stolen. Such “wrench attacks” involve physical threats or violence used to force cryptocurrency holders to surrender assets.

The incident comes amid other hardware wallet security events. Earlier this month, Ledger asked resellers across Southeast Asia and Hong Kong to suspend sales following reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases. In late July, Coldcard manufacturer Coinkite warned users after attackers exploited a bug that caused its devices to generate wallet seeds with less entropy than intended, resulting in the theft of millions of dollars in crypto. Trezor and SafePal each disclosed customer-data breaches in August, affecting 13,689 customers and about 39,798 customers, respectively, while Ledger’s 2020 leak eventually reached about 292,000 customers.