Keystone Pulls 18,835 Unsold Hardware Wallets After Authenticity Key Is Stolen

Oleh Coinvote

Diterbitkan October 27, 2026 - 11:23 UTC | 4 menit membaca

Hardware wallet maker Keystone will destroy 18,835 unsold devices and pause shipments after an attacker took a permanent key used to confirm that its wallets are genuine. Customer shipping records were also exposed, and a second maker, Foundation, disclosed its own breach.

Keystone halts shipments and scraps stock after a website intrusion

Keystone will destroy 18,835 unsold hardware wallets and suspend shipments, CoinDesk reported, after an attacker reached the company's website on Oct. 20. Keystone said the attacker got in through a vulnerability in an outside service the company used to monitor data.

According to Protos, Keystone detected the unauthorized access on Oct. 20 and confirmed on Oct. 23, after checking API activity with Shopify, that a third party had obtained customer shipping information. The company apologised to customers in a post on X. The Defiant summarised the outcome in its headline as the destruction of 18,835 wallets following the theft of a device-authentication key.

Why a stolen authentication key is harder to fix than a leaked address list

Hardware wallets can carry a manufacturer key that lets an online check confirm a device is genuine. CoinDesk said Keystone's key is built into each device during production and cannot be changed afterwards. Keystone warned that a copy of it could let counterfeit wallets pass the authenticity check and look real.

That is why the company is scrapping inventory rather than patching it. Units already built with the old key cannot be updated, so Keystone said new devices will use a replacement key. Counterfeit hardware is a real concern for buyers because a tampered wallet can be set up to expose a recovery phrase, even when the buyer follows every step correctly.

The figures reported so far

The numbers below come from the outlets' accounts of Keystone's own statements and from the two Foundation updates they describe.

According to CoinDesk, 25,964 buyer records dating from 2024 to 2026 were exposed, including customer names, contact information, delivery addresses and details of orders.
CoinDesk said a further 12,873 unpaid checkout records may also have been touched. Protos describes these as about 13,000 incomplete purchase records.
Keystone said recovery phrases, private keys and wallet credentials were not exposed.
Keystone's retention policy called for deleting shipping data after 180 days. The firm will cut retention to 90 days.
Foundation reported more than 23,000 phishing email attempts, according to CoinDesk. Protos gives the figure as over 20,000.
Foundation said the records open to attackers held about 5,600 mailing addresses and 5,200 phone numbers, though the number actually accessed was not confirmed.

Where the outlets agree, and where their accounts differ

CoinDesk and Protos agree on the core facts: the breach, the stolen key, the roughly 26,000 exposed records and the plan to destroy almost 19,000 devices. They differ on timing. CoinDesk says Keystone's update was posted on Monday, while Protos says the first confirmation of a customer-data breach came on Saturday and was followed by a later update.

Protos adds detail that CoinDesk does not. It reports that the confirmation arrived about 18 hours after a customer described a social engineering call that used Keystone order information. It also says another 25,000 records had already been permanently erased under the retention policy, and that the automated deletion tool did not operate reliably.

CoinDesk, for its part, gives the entry point as a third-party monitoring tool and ties the failed deletion to the company not noticing the fault. The Defiant was available only as a headline and summary, so it supports just the 18,835 figure and the warning about extra checks for certain devices.

What Keystone owners can check

Per CoinDesk, Keystone considers units delivered ahead of Oct. 20 still usable provided they clear the authentication check. For old-key devices that arrived later than that date, owners are advised to obtain additional checks prior to using them, and The Defiant's summary repeats that such wallets need extra verification even if they pass the online test.

According to Keystone, the breach by itself gives owners no reason to transfer their funds elsewhere. The company also told users to be wary of bogus messages about product recalls or moving assets. Protos adds that the company cautioned about people impersonating its employees to promise reimbursements, new hardware or repairs tied to an order or address, an approach that stolen order details could make more convincing.

A run of incidents across hardware wallet makers

CoinDesk said the Keystone breach follows other attacks on hardware wallet users this year. At Ledger, devices sold through resellers in Southeast Asia were fitted with hidden components that captured recovery phrases during setup. Coldcard's seed-generation software contained a bug that allowed attackers to rebuild private keys and empty wallets remotely.

Protos says those two episodes together led to losses above $200 million and lists earlier leaks involving Trezor and SafePal. It also reports that Coldcard's X account was compromised earlier this month to publish a phishing link to its 67,000 followers.

Foundation's case has a similar pattern. Protos traced phishing emails sent from its official domain to compromised Cloudflare API keys. Foundation also discovered earlier copies of its database that were left untouched by its 60-day deletion process. According to CoinDesk, Foundation reported no sign that Passport devices or private keys had been compromised.

Open questions to watch

Keystone has not said, in the reporting available, how owners of old-key devices received after Oct. 20 should carry out the additional checks. That guidance will matter most for the customers in that group.

Two further questions remain open. Foundation told Protos it was still determining how many users had personal data exposed. And both firms disclosed deletion processes that did not work as promised, which raises the question of how many other wallet makers rely on retention tools they do not test.

FAQ

Is my Keystone wallet safe to use after the breach?

CoinDesk reported that Keystone considers devices delivered before Oct. 20 safe if they pass authentication. For old-key devices that arrived later than that date, owners are advised to obtain additional checks prior to using them. Keystone said recovery phrases and private keys were not exposed.

Do Keystone users need to move their funds?

According to Keystone, the breach by itself gives owners no reason to transfer their funds elsewhere. The company told users to be wary of bogus messages about product recalls or moving assets, and Protos noted warnings about scammers offering refunds or replacement devices.

What did the attacker take from Keystone?

According to CoinDesk, the attacker obtained 25,964 buyer records and a permanent key that lets wallets pass online authenticity checks. A further 12,873 unpaid checkout records may also have been touched.