Keystone halts web orders and will destroy 18,835 wallets after security breach

Hardware wallet maker Keystone announced on October 26, 2026, that it will destroy 18,835 unsold units and suspend website shipments following an October 20 breach. Exploiting a third-party monitoring tool, intruders compromised a factory-burned WebAuth key, risking counterfeit device validation. The breach exposed 25,964 buyer records, revealing a failure in Keystone's automated 180-day deletion tool. In response, Keystone is updating manufacturing keys, lowering retention limits to 90 days, and advising users on safe verification.

Hardware inventory destruction and order changes

• ▪Keystone froze unsent website orders and shifted online sales to preorders while manufacturing units with a newly generated WebAuth key
• ▪Keystone announced that it will destroy 18,835 unsold hardware wallets in its inventory to prevent potential counterfeit devices from passing online verification

Security breach and stolen key

• ▪An intruder who breached Keystone's website on October 20, 2026, obtained a WebAuth key used during manufacturing to verify device authenticity, which cannot be erased or rewritten once burned into hardware
• ▪Keystone stated that the WebAuth key stolen in the October 20 breach does not play a role in generating recovery phrases, deriving private keys, or signing cryptocurrency transactions
• ▪An attacker gained unauthorized access to the Keystone website by exploiting a vulnerability in an unnamed third-party data monitoring tool

Data retention failure and policy updates

• ▪Following the October 20 breach of Keystone's website, Keystone shortened its customer data retention limit from 180 days to 90 days and requested that Shopify erase checkout records older than 30 days
• ▪Keystone acknowledged retaining 25,964 customer buyer records beyond its 180-day policy because an automated bulk-erasure tool failed without detection

Customer safety guidance and scam warnings

• ▪Keystone confirmed hardware wallets delivered before October 20, 2026, are safe if authenticity checks pass, but advised contacting support before initializing devices received with the old WebAuth key after October 20, 2026
• ▪Keystone explicitly warned users that it will not request physical device returns and cautioned against scam messages claiming to offer device recalls or asset migrations