Keystone hardware wallet maker lost factory authentication key to attackers, exposing 25,964 user records to potential counterfeit device fraud.
Security & Exploits ·
Keystone, a Bitcoin hardware wallet maker, disclosed that attackers obtained its factory authentication key after a breach detected on October 20, exposing 25,964 customer records from its Shopify store spanning 2024 to 2026. The company said the compromised data included names, contact details, and shipping addresses, but that recovery phrases and private keys were not involved. The manufacturer is destroying 18,835 unsold wallets and has suspended shipments of unshipped orders.
The WebAuth key—a permanent code embedded in each device at the factory to authenticate genuine hardware—allows attackers to create counterfeit wallets that would pass Keystone's verification checks. Such devices could be sold to unsuspecting buyers who load their cryptocurrency onto them, creating a vector for theft. Devices shipped before October 20 remain unaffected.
Keystone acknowledged a separate operational failure: an automated tool designed to delete customer records after 180 days malfunctioned, leaving personal information retained beyond the permitted retention window. The company did not disclose the attacker's identity or when the breach first occurred. Hardware wallet makers have faced repeated breaches targeting customer lists—incidents at Ledger, Trezor, and SafePal in prior years have similarly exposed purchase information that could facilitate targeted attacks.