Keystone will destroy 18,835 wallets after authentication key theft

Keystone said on October 26, 2026 that an attacker stole its WebAuth authentication key, exposed 25,964 buyer records from its Shopify store, and will destroy 18,835 unsold wallets that carry the compromised key. The records span 2024 to 2026 and cover names, shipping addresses, contact details, and order information. Keystone said the incident did not expose recovery phrases, private keys, or wallet credentials; Cointribune and ForkLog note that claim has not been independently confirmed.

Keystone burns the WebAuth key into each device during production, and the company says it cannot remove or change the key after that. To authenticate a device, the owner scans a QR code on Keystone’s verification page and types the code the device shows; the device decrypts the QR code using a key held in write-once memory that accepts only one key, so manufacturers cannot switch shipped devices.

Someone with the key “could use it to produce counterfeit devices that pass authentication checks”, Keystone said, and counterfeits sold to buyers would create a risk of asset theft. According to Keystone, the key has no role in making recovery phrases, deriving private keys, or signing transactions.

Devices delivered before October 20, 2026 that pass authentication remain usable, Keystone said. For devices received after that date carrying the old key, the company said, “Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit.”

The company said it has not linked any counterfeit devices or customer-asset thefts to the incident, and it also has not said whether fake devices are already circulating. Owners of devices received after October 20 should contact Keystone support at support@keyst.one for verification before use.

The company said on October 26, 2026 that it will destroy 18,835 unsold wallets carrying the compromised key instead of selling or shipping them. Keystone halted shipments of unshipped website orders and moved website sales to preorders pending new devices built with a different authentication key; Keystone expects those devices within 4 to 6 weeks, and as of October 27, 2026 the Keystone 3 Pro was listed as a pre-order with the same shipping window. Sales through Amazon and other channels were not affected, though the company has not said whether old-key devices remain on sale through its Amazon official stores and authorized resellers. Keystone has made regulatory filings with authorities in the EU and the UK, among other jurisdictions.

Keystone said the automated tool it uses to delete buyer records failed to erase them after 180 days as promised, so data stayed on file longer than permitted; the company has also reduced how long it keeps customer data, from 180 days to 90 days. Keystone said it did not erase customer data within the time it promised, and the company accepted responsibility for the lapse.

Still, as of October 27, 2026, the privacy policy listed a 180-day retention period even though the policy, updated on July 7, 2026, counts that period from the last purchase rather than the order date. ForkLog reports some customers received breach notices more than 180 days after their orders, including one gap of 214 days.

The company is e-mailing affected customers and plans to add a page where they can check whether their information was affected, but its device verification page had no instructions as of October 27, 2026 for owners of devices received after October 20, and the company has not explained how customers can tell which key their device uses. On October 24, 2026, Keystone asked Shopify to erase overdue buyer data, expecting completion by November 3, 2026, and it separately asked Shopify to remove personal data from checkout records held for more than 30 days. The company expects the overdue-data erasure to be complete on November 3 after a 10-day waiting period.

Affected customers should expect an email from Keystone and can use the planned page to check whether their information was affected. Owners of devices received after October 20 should contact Keystone support at support@keyst.one for verification before use. Keystone said it will never ask customers to return a device, so a request to return one under a recall is not legitimate. The company has not said what owners who have already sent cryptocurrency to a post-October 20 device should do.

Keystone is not the only hardware-wallet maker to disclose a breach this year. In August, Trezor and SafePal disclosed customer-data breaches affecting 13,689 and roughly 39,798 customers, respectively, and ForkLog reports that in September 2026 Trezor added 67,000 affected individuals to its ShipMonk breach, bringing the total to nearly 81,000. Gizmodo puts the ShipMonk breach at about 80,000 Trezor customers, and says a Brevo e-mail incident exposed subscribers and also affected BitBox. Decrypt reports a 2020 Ledger data leak that ultimately affected approximately 292,000 customers, and Ledger disclosed a January breach at a third-party payment processor exposing customer names and contact information.

Foundation disclosed a separate breach on October 25, 2026 involving phishing e-mails that appeared to come from its official domains. The company found more than 23,000 phishing email attempts and said no Passport devices or private keys were breached, and Zach Herbert said, “Passport devices are safe and secure.”

According to Foundation, older database copies contained about 5,600 addresses and 5,200 phone numbers. Coindesk describes a Coldcard flaw that allowed attackers to rebuild private keys and empty wallets remotely, plus a Ledger supply-chain attack in which attackers installed hidden components in devices before customers received them.

CertiK counted 52 verified wrench attacks worldwide during the first half of 2026, up 33 percent from 39 during the same period of 2025; wrench attacks are physical assaults in which assailants demand cryptocurrency. Chainalysis said 46 violent attacks took place in the first half of 2026, with more than $30 million in thefts, and it estimated physical-attack losses at over $100 million as of August 2026. AMBCrypto counted 122 crypto-related physical attacks across 31 countries during 2026, with France the main hot spot.