Keystone website breach exposes 25,964 buyer records and device key
Security & Exploits ·
Keystone Hardware Wallet confirmed an intrusion into its official website that leaked tens of thousands of customer records and a device-authentication credential, prompting it to scrap thousands of units already in stock.
Keystone said on X that security monitoring flagged abnormal website activity on October 20, 2026, and that the company quickly shut down sensitive functions, blocked the intrusion, patched the flaw and opened a forensic review. The attacker got in by abusing a weakness in a third-party data-monitoring tool connected to the site, which let them escalate privileges and pull customer data along with a key used to confirm device authenticity, according to wublockchain.xyz.
Of 51,083 total Shopify buyer records tied to the official store, 25,119 had already been purged under Keystone's retention rules before the breach occurred; the remaining 25,964 records, spanning purchases made between 2024 and 2026, still held names, contact details, shipping addresses and order history. Keystone attributed the gap to a bulk-deletion tool that silently failed on some entries instead of removing them after the intended 180-day window. A separate batch of 12,873 unpaid checkout records, containing partial contact and shipping data submitted during abandoned purchases, was also exposed. Keystone filed erasure requests with Shopify on October 24, 2026 for both data sets, with the buyer-record cleanup expected to finish by November 3, 2026 after a mandatory ten-day hold.
The more consequential exposure was the WebAuth key, embedded in devices at manufacturing time and used solely to verify that a device is genuine Keystone hardware. Because this key cannot be erased or rewritten and plays no role in seed-phrase generation, private-key derivation, or transaction signing, Keystone said wallet funds and recovery phrases are not at risk. The danger instead lies in forgery: anyone holding the leaked key could potentially build counterfeit devices capable of passing Keystone's authentication check, a point both the company and wublockchain.xyz emphasized.
In response, Keystone halted manufacturing with the compromised key and switched all new production to a freshly issued one. It is destroying 18,835 units currently sitting in inventory that still carry the old key rather than selling or shipping them, and has paused fulfillment of unshipped website orders in favor of a preorder model until new-key production is up and running. Devices already delivered before October 20, 2026 remain trustworthy if they pass authentication, while units received after that date will need manual verification through customer support despite passing the check.
Keystone warned customers to disregard any messages requesting device returns, "asset migration," or "wallet verification," calling such outreach fraudulent rather than company-initiated. What remains unresolved is the full scope of the attacker's access to the leaked authentication key and whether any counterfeit devices have already been produced or distributed using it.