Keystone will destroy 18,835 unsold hardware wallets after attackers stole the key that proves its devices are genuine

Keystone has gone further than its first breach notice on Saturday. In an update on Monday, the hardware wallet maker said an attacker exploited a flaw in a third-party monitoring tool on its website, detected and blocked on October 20, and took the authentication key written into each device at the factory. The key cannot be changed, so Keystone will destroy 18,835 unsold wallets that carry it, suspend shipping of web orders and move its store to pre-orders until devices with a new key exist, according to CoinDesk, The Hacker News and Decrypt.

The key is used for the online genuineness check, not for recovery phrases, private keys or signing. Anyone holding it could build fakes that pass that check. Keystone says devices delivered before October 20 can be used normally if they pass the check; owners who received a device after that date should contact support before using it. It says it will never ask customers to send a device back, so recall messages should be treated as scams.

Separately, Keystone said 25,964 buyer records from 2024 to 2026 were exposed, and admitted its automated deletion tool failed to remove data on time. Retention is now 90 days.