Keystone website and authentication-key breach stories

Oct 26, 2026

Keystone halts web orders and will destroy 18,835 wallets after security breach

Hardware wallet maker Keystone suspended online orders and announced it will destroy nearly 19,000 unsold devices after attackers stole an authenticity verification key in a website breach. The incident also exposed 25,964 customer records containing names and addresses.

Oct 26, 20262 sources

Oct 24, 2026

Keystone hardware wallet website breach exposes customer data

Keystone Hardware Wallet disclosed that its website was breached on October 20, exposing customer names, contact details, shipping addresses and order information, though payment details and private keys were not compromised.

Oct 24, 20262 sources

Top claims

▪Keystone stated that the WebAuth key stolen in the October 20 breach does not play a role in generating recovery phrases, deriving private keys, or signing cryptocurrency transactions
▪Keystone confirmed hardware wallets delivered before October 20, 2026, are safe if authenticity checks pass, but advised contacting support before initializing devices received with the old WebAuth key after October 20, 2026
▪Keystone explicitly warned users that it will not request physical device returns and cautioned against scam messages claiming to offer device recalls or asset migrations

Subtopics

Crypto security2 Crypto wallets2 Cybercrime2 Hardware wallet2 Self-custody2 Bitcoin wallets & custody1 Key management1 Wallet & key compromise1

Related timelines