Keystone, a hardware wallet maker, is taking drastic action after a recent security breach in which attackers stole its device verification key. The compromised key is used in authenticating hardware wallets—that step users follow to confirm their device is legitimate—raising fears that criminals could build counterfeit units that mimic genuine ones. The attack affected unsold devices, customer records, and forced a change in how Keystone handles verification and data security.
What Happened: Breach Details
On October 26, Keystone revealed that its website had been compromised, allowing an attacker to access the device verification key. Someone possessing this key could create fake hardware wallets that still pass Keystone’s existing authentication check. Importantly, user recovery phrases and private keys—needed to access cryptocurrency—were not affected.
The incident was discovered and access was blocked on October 20 after the attacker exploited a flaw in a third-party data monitoring tool used by Keystone’s web platform. That flaw enabled the attacker to escalate privileges and obtain not only customer shipping data but also the verification key. Keystone has since patched the vulnerability.
Scope of Impact
Keystone plans to destroy 18,835 unsold devices that still carry the compromised key, and going forward, every newly manufactured device will use a new verification key. Devices shipped before October 20 are considered safe if they pass Keystone’s verification check; those delivered after that date but carrying the old key are potentially susceptible to being counterfeit.
In addition to hardware worries, Keystone also disclosed that data for 25,964 past customer orders between 2024 and 2026 were exposed, including names, addresses, contact info, and order details. Unfinished transactions—totaling another 12,873—were also affected. Keystone says payment info, IDs, and government documents were not part of the breach.
What Keystone Is Doing & How Users Should Respond
The company has shortened its data retention policy from 180 days to 90 days and asked Shopify to delete customer shipping info older than 90 days, aiming for full compliance by November 3. Affected customers are being notified via email and will be able to check whether their details were compromised on a forthcoming status page.
Keystone’s advice depends on when a device arrived. If it was shipped before October 20 and checks out via the verification process, users can continue to use it normally. For devices received after October 20 with the old key, Keystone urges users to contact support and only start using the device once its authenticity is confirmed. Pending orders are paused until devices with the new key are ready. Buyers who got devices through Amazon or other authorized resellers follow the same arrival-date guidance.
Crypto holders with Keystone devices need not immediately move their funds. Potential risk is only for devices delivered after October 20 with the now-compromised key. As always, Keystone warns against entering recovery phrases on devices from unknown sources and emphasizes verifying the authenticity of any communications or replacement offers.
How Keystone’s Device Check Mechanism Works
Keystone’s verification process uses a QR code displayed on the website, which owners scan with their device. The device decrypts the code using its embedded key; if the decryption succeeds, the device passes the check. That key gets written during manufacturing and is immutable in firmware—it can’t be replaced once set.
Because the compromised key is tied only to this verification mechanism—not to any cryptographic functions like signing transactions or generating private keys—a counterfeit fake could pass the legitimacy check but still expose users to crypto theft.
Keystone has reported no confirmed thefts or fake devices in the wild yet.
