Keystone: website breach steals device-authenticity key, 18,835 hardware wallets to be destroyed (no CVE)
Severity: high · Patch status: partial · Since 2026-10-26
Hardware wallet maker Keystone said an attacker exploited a vulnerability in a third-party monitoring tool on its official website, escalated privileges and obtained customer data plus the key used to verify that its devices are genuine. With that key, counterfeit wallets could pass Keystone's authenticity check and reach customers. Keystone will destroy the 18,835 devices in inventory that carry the compromised key, has paused production shipments until devices are made with a new key, and says it cannot guarantee the authenticity of devices delivered after October 20. Of 51,083 Shopify buyer records, 25,119 had already been deleted under a 180-day retention policy and 25,964 records from 2024 to 2026 may have been stolen, plus 12,873 incomplete-checkout records; an automated erasure tool had failed unnoticed. Customers who received a device after October 20 should contact Keystone support for verification.
What to do
- If you received a Keystone device on or after 2026-10-20, contact Keystone support to verify its authenticity before setting it up.
- Do not use a device you cannot verify as genuine; buy only from Keystone's own channels once shipments resume with the new key.
- Buyers in the Shopify store data (2024-2026): expect targeted phishing using your name, contact details, address and order history; never enter a recovery phrase anywhere on request.
- Operators of similar stores: patch or remove third-party monitoring tools on the storefront and keep key material off systems reachable from them.
Sources
All live incidents on Threat Watch
