Keystone Wallet Destroying 18,835 Devices After Breach Exposes Authentication Key
A crypto hardware wallet maker is destroying nearly 19,000 unsold devices following a website breach that exposed a device authentication key.
The firm says the incident was detected on October 20th, 2026, after attackers exploited a vulnerability in a third-party data monitoring tool.
“Our investigation found that the attacker exploited a vulnerability in a third-party data monitoring tool used by our website to escalate privileges. This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices.”
The breach exposed 25,964 buyer records containing personal information such as names, contact details, shipping addresses, and order data from 2024 to 2026, along with 12,873 unpaid checkout records and the WebAuth key used to verify genuine devices.
No recovery phrases, private keys, or payment information were affected.
The company says the exposed key, written into devices during manufacturing and impossible to erase or rewrite, could enable counterfeit wallets that pass authenticity checks and risk asset theft for users.
“The key forms the foundation of trust for our device authentication mechanism. If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks. These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft… We sincerely apologize for this incident.”
In response, the firm is halting use of the old key in production, destroying the 18,835 devices in existing inventory that contain it, suspending shipments of unshipped orders, and switching to a preorder model until new devices with a fresh key are ready.
It has shortened data retention from 180 days to 90 days, submitted erasure requests to Shopify, and reported the incident to regulators in the EU, UK, and elsewhere.
Devices shipped before October 20th, 2026, remain valid if they pass authentication.
The company is urging users to avoid scams claiming to offer asset migration, wallet verification or investigation assistance.
Follow us on X, Facebook and Telegram
Don't Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
The post Keystone Wallet Destroying 18,835 Devices After Breach Exposes Authentication Key appeared first on The Daily Hodl.
