Keystone halts sales after hackers steal device authentication key

Bitcoin hardware wallet maker Keystone suspended device shipments and announced plans to destroy 18,835 unsold devices after an attacker exploited a third-party monitoring tool to steal its factory authentication key on October 20, 2026. The breach also exposed 25,964 customer records from 2024 to 2026 due to an automated data erasure tool failure, along with 12,873 incomplete checkout records on Shopify. Keystone confirmed that private keys remain secure and devices delivered before October 20 are safe.

Keystone response and hardware destruction

• ▪Keystone announced on October 26, 2026, that it will destroy 18,835 unsold hardware wallet devices in its inventory carrying the compromised WebAuth key stolen in the October 20, 2026 breach
• ▪Keystone transitioned website sales to preorders and submitted breach reports to regulatory authorities in the European Union, United Kingdom, and other jurisdictions
• ▪Keystone suspended all hardware wallet production shipments on October 26, 2026, pending the manufacturing of new devices using an updated authentication key

WebAuth key compromise and authenticity risks

• ▪Keystone stated that hardware wallets manufactured and delivered before October 20, 2026, remain safe and that their private keys and recovery phrases were not compromised
• ▪Keystone stated that the WebAuth key stolen in the October 20, 2026 breach allows attackers to manufacture counterfeit hardware wallets that pass official authenticity checks, creating a risk of asset theft for buyers
• ▪Keystone confirmed that the compromised WebAuth key stolen in the October 20, 2026 breach is written permanently into hardware during factory production and cannot be erased or rewritten
• ▪On October 26, 2026, Bitcoin hardware wallet manufacturer Keystone disclosed that an attacker obtained its factory WebAuth device authentication key used to verify hardware authenticity

Customer data exposure and retention failure

• ▪Keystone's October 20, 2026 breach exposed an additional 12,873 uncompleted customer checkout records retained by Shopify for Keystone purchases
• ▪An attacker in the October 20, 2026 Keystone breach accessed 25,964 buyer records from Keystone's Shopify store dating from 2024 to 2026, containing customer names, contact details, order information, and shipping addresses
• ▪Keystone attributed the retention of exposed customer data to a failure in its automated bulk-erasure tool, which failed to execute data deletion beyond its 180-day retention policy
• ▪Keystone reduced its customer data retention policy from 180 days to 90 days following the October 20, 2026 breach

Recent security incidents among competitor manufacturers

• ▪Hardware wallet manufacturers Trezor and SafePal both disclosed customer data security breaches in August 2026
• ▪In July 2026, Coinkite warned Coinkite Coldcard users about a seed generation entropy defect that enabled cryptocurrency theft