Keystone will destroy 18,835 hardware wallets after a key theft

Keystone says an attacker who got into its website on 20 October took the key its devices use to prove they are genuine. Manufacturers burn that key in during production, so it cannot be swapped out on units already built. Keystone will destroy the 18,835 devices in inventory that carry it, has stopped shipping and moved to preorders until it can make devices with a new authentication key.

“These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products”

— Keystone, on what a holder of the stolen key could build, https://cointelegraph.com/news/keystone-breach-deepens-hackers-stole-key-used-to-verify-wallets-as-genuine

Devices made and delivered before 20 October are safe and their authenticity checks still hold, the company says. For anything delivered after that date it cannot guarantee authenticity and asks buyers to contact support. No counterfeit device using the stolen key has turned up yet. Keystone says recovery phrases, private keys and wallet credentials were not touched.

The retention policy cleared half of what it covered

The attacker reached the customer side through a vulnerability in a third-party monitoring tool on the website, which let them escalate privileges. Keystone's Shopify store had generated 51,083 buyer records. A 180-day retention policy had deleted 25,119 of them. The other 25,964, covering 2024 to 2026, survived because the automated bulk-erasure tool did not work, and those are the records the attacker may have taken. By our count the policy cleared 49% of them and left 51% in place. The attacker may also have reached 12,873 checkout records from abandoned purchases.

What leaked is names, contact details and shipping addresses. Chainalysis counted more than $30m taken in physical attacks on crypto holders in the first half of 2026. A list of people who bought a hardware wallet and had it delivered to a home address is the targeting data for that category of attack, and an address stays valid for years. A Korean exchange lost staff data the same way this week, through a system nobody thought of as the front door.

Six makers in one year

Coinkite warned Coldcard users in late July after attackers exploited a bug that generated seeds with less entropy than intended, and users lost millions of dollars. A breach at Trezor's shipping partner in August exposed customer information, and the count passed 80,000 by September. SafePal exposed data on close to 40,000 customers through an order-tracking flaw the same month. BitBox was hit by a phishing campaign through a compromised email provider in September. Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales this month over reports of implants that could capture recovery phrases.

Keystone makes six makers in a single year, and the three that published numbers account for at least 145,964 customer records between them. BitBox and Ledger gave none. Ledger's June 2020 breach put more than a million email addresses, names, phone numbers and physical addresses in public, and the phishing off that list ran for years.

At the $149 price guides list for the Keystone 3 Pro, 18,835 units come to roughly $2.8m of stock going into a shredder because one secret cannot be rotated. Google showed a custody service for banks the same week that splits a key across three separate environments so no single machine holds the whole thing. One key per device is a design choice someone made.

Informational material, not investment advice. The incident details, device and record counts and the quote come from Keystone through Cointelegraph on 28 October 2026. The physical-attack figure is Chainalysis' first-half tally. The 49% split, the 145,964 total and the inventory value are our arithmetic, and the $149 is a third-party price guide rather than Keystone's own listing.