Keystone Breach Widens as Attacker Grabs Its Device Authentication Key
The hardware wallet maker will destroy 18,835 old devices and says it can't fully rule out fakes among units received after Oct. 20th.
Keystone’s store breach just got a lot more serious. In a fresh update on Monday (Oct. 26th), the hardware wallet maker said the attacker behind the breach it detected on Oct. 20th also took the key it uses to confirm devices are genuine.
As a result, Keystone is scrapping the 18,835 wallets in its inventory that carry that key.
What’s the Scoop?
Why it matters: The WebAuth key is written into each device at the factory and can’t be changed afterward. It has no role in creating seeds or signing transactions. In the wrong hands, though, it could let fakes pass Keystone’s own authenticity check. New units will get a fresh key, and website orders are on hold in favor of preorders until that batch is ready.
What leaked: The attacker got in through a flaw in an unnamed third-party monitoring tool on Keystone’s Shopify-based site. That exposed 25,964 buyer records from 2024 to 2026, including names, contact info, addresses, and order details. Keystone is also counting 12,873 unpaid checkout records as a precaution. It says seeds, private keys, bank payment info, and government IDs are safe, and its Amazon sales weren’t affected.
Enjoying this article?
Subscribe to Bankless or sign in
A broken promise: Keystone had advertised that it wipes shipping data within 180 days. Over the weekend, customers flagged that older orders were exposed anyway, The Block reported. Keystone has now confirmed it: some tasks in its automated erasure tool failed, and the company didn’t catch them in time. It’s cutting retention to 90 days.
What owners should do: Keystone says a device delivered before Oct. 20th that passes authentication is genuine. For old-key units received after that date, the company says it “cannot completely rule out the possibility that it is counterfeit,” even if the check passes. If you have one, contact support for extra verification before using it. Keystone also says it won’t ask anyone to return a device, so any “recall” request is a scam, and so are offers to migrate your assets or verify your wallet.
Bankless Take
Keystone isn’t the first wallet maker this year to face big problems. Trezor says a breach at its shipping partner ShipMonk exposed 80,689 customers, including people whose data ShipMonk had assured it was deleted. Ledger found LTE spy chips hidden in devices from one reseller, and onchain researchers tie them to a drain they peg at +$86M. And on Sunday night, Foundation traced phishing emails that appeared to come from its official domains to compromised Cloudflare API keys.
Attackers are mostly leaving the secure chip alone and going after everything around it. So buy direct from the manufacturer if you do make a buy, and only ever enter a seed into a device you ordered yourself.
William M. Peaster
William M. Peaster, Senior Writer, has been with Bankless since January 2021. Immersed in Ethereum since 2017, he covers the onchain frontier with a particular interest in art, games, and other culture apps. He has a background in creative writing and writes fiction in his free time.
