Keystone to Destroy 18,835 Hardware Wallets After Attackers Steal Its Device Authentication Key

Published October 27, 2026, 2:45 AM PKT. Based on Keystone's October 26, 2026 security announcement (primary source), and reporting by crypto.news, CoinMarketCap Academy and TokenPost on October 26, 2026 (secondary sources). This is a follow-up to MABOnChain's October 25, 2026 article on Keystone's disclosure that its website breach had exposed customer shipping data.

Hardware wallet maker Keystone will destroy 18,835 devices in its inventory after attackers stole the WebAuth key it uses to verify that its wallets are genuine, the company said in an October 26 security announcement. The disclosure widens a website breach first detected on October 20 that MABOnChain reported on October 25, when Keystone disclosed only that customer shipping data had been exposed. The new finding changes the risk: a stolen authentication key could let counterfeit devices pass the checks buyers use to confirm a wallet is genuine.

The stolen WebAuth key: what it can and cannot do

The stolen credential, known as the WebAuth key, is embedded into Keystone hardware wallets during manufacturing and is used when customers check their devices through the company's authentication website, according to crypto.news. Keystone explained that the key cannot be erased or rewritten once it has been installed. Although it has no role in generating recovery phrases, deriving private keys or signing transactions, its exposure creates a problem with the company's device verification process.

Keystone put the counterfeit risk plainly in its statement on X, as quoted by CoinMarketCap Academy: "If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks. These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft." Attackers possessing the key could potentially produce counterfeit wallets capable of passing the authentication checks that customers normally use to confirm whether their devices are legitimate, according to crypto.news.

Keystone has stopped using the compromised key in manufacturing and will replace it with a new one, according to crypto.news. All 18,835 devices currently in inventory that contain the compromised key will be destroyed. The company has suspended shipments of unfulfilled orders placed through its website, and sales will continue through a preorder model until manufacturing and shipping can resume with the replacement key.

The breach and the data: October 20 entry, 25,964 records, a failed deletion tool

Keystone said its monitoring systems detected unusual access to its website on October 20, according to CoinMarketCap Academy. The attacker exploited a vulnerability in a third-party data monitoring tool used by the site to escalate privileges, the company said. The company blocked the unauthorized access and disabled sensitive website functions on October 20, before fixing the vulnerability and beginning a forensic investigation, according to crypto.news.

The investigation identified 51,083 purchase records associated with Keystone's official Shopify store, although personal information belonging to 25,119 of those records had already been erased before the attack, according to crypto.news. The remaining 25,964 records contained customer names, contact information, shipping addresses and order details from purchases made between 2024 and 2026. Investigators identified another 12,873 incomplete checkout records containing personal information submitted by customers who never completed payment.

Keystone said its data retention procedures contributed to the exposure because an automated deletion tool had failed to remove some customer records within the company's required 180-day period, according to crypto.news. The company acknowledged that it had not detected the failed deletion requests in time, leaving information stored longer than permitted. Following the investigation, Keystone shortened its customer data retention period to 90 days and submitted deletion requests to Shopify on October 24 for overdue purchase records. Shopify requires a 10-day waiting period before those requests are finalized, with deletion expected by November 3, according to crypto.news, and separate requests were submitted for incomplete checkout information retained longer than 30 days.

The company said recovery phrases, private keys, wallet credentials, banking information and government identification numbers were not compromised, according to crypto.news. CoinMarketCap Academy likewise reported that recovery phrases, private keys and bank payment information were not involved, and that users do not need to move their assets solely because of the incident.

What owners should do: pre-October 20 devices pass, post-October 20 devices need extra checks

Keystone said devices delivered before October 20 remain safe to use if they pass authentication, according to crypto.news. Customers who received devices after that date containing the old key have been advised to contact support for additional verification before using them. CoinMarketCap Academy quoted the company's warning directly: even if such a device passes authentication, "we cannot completely rule out the possibility that it is counterfeit."

The company has ruled out asking customers to return their wallets and warned that anyone requesting devices under the pretext of an official recall should be treated as a scammer, according to crypto.news. Keystone also warned users against messages offering wallet migration, asset verification or investigation assistance, emphasizing that the incident does not require existing owners to move their cryptocurrency, according to crypto.news.

Affected customers will receive individual email notifications, while a planned lookup page will allow users to check whether their information was exposed, according to crypto.news. A separate service will eventually let customers confirm whether their personal data has been erased. Keystone has committed to reviewing its data access controls, authentication key management and deletion procedures as part of a security audit, and the company said regulatory and law enforcement reports had already been submitted in the European Union, United Kingdom and other jurisdictions, with more reporting planned wherever required.

A month of wallet warnings: Ledger implants, Trezor and BitBox phishing

The Keystone update lands in a month already full of hardware wallet warnings. The warning comes after Ledger investigated compromised devices distributed through a Southeast Asian reseller in October, according to crypto.news, where investigators identified an unauthorized hardware implant inside one affected wallet that could capture recovery phrases during setup. Customer information leaks have affected other hardware wallet manufacturers this year, according to crypto.news: in September, Trezor and BitBox warned customers about phishing emails following security problems involving third-party service providers, and Trezor had previously disclosed that a breach involving its shipping provider ShipMonk exposed information belonging to more than 80,000 customers.

Keystone's case differs from those in one respect that matters to buyers: the risk here is not only that personal data leaked, but that the authenticity check itself can no longer be trusted for the old key. Until replacement-key devices ship, the company's own advice draws the line by date, and any message that asks owners to send a device back, migrate funds, or verify a wallet outside Keystone's official channels should be treated as part of the scam wave the breach has already enabled.

This article is news reporting and is not investment advice.

Sources

• Keystone, October 26, 2026 security announcement (statement on X), primary source
• crypto.news, Keystone to destroy 18,835 hardware wallets after authentication key breach (October 26, 2026), secondary source
• CoinMarketCap Academy, Keystone to Destroy 18,835 Hardware Wallets After Authentication Key Theft (October 26, 2026), secondary source
• TokenPost, Keystone Breach Exposes 25,964 Hardware Wallet Purchase Records (October 26, 2026), secondary source
• MABOnChain, Keystone Discloses Website Breach Exposing Customer Shipping Data, Warns of Impersonation Scams (October 25, 2026), prior coverage