Keystone to destroy 18,835 hardware wallets after attacker steals device verification key via website breach
Keystone disclosed on October 26 that an attacker who gained access to its website obtained the key its hardware wallets use to prove they are genuine. A holder of the key could build counterfeit devices that pass the online authenticity check and sell them to buyers, leading to crypto theft. Keystone will destroy 18,835 unsold devices carrying the key and will issue a new key on all new devices. The same intrusion exposed 25,964 buyer records (2024-2026) plus 12,873 unpaid checkout records. Recovery phrases and wallet private keys were not involved, and Keystone has reported no counterfeit devices or thefts.
Entenda a falha
A vulnerabilidade
An unnamed vulnerability in a third-party data monitoring tool used by the Keystone website let an attacker escalate privileges. The attacker then reached customer data and the key Keystone hardware wallets use to prove they are genuine. No CVE, affected versions or fixed versions are given, but Keystone says it has fixed the flaw. Keystone does not say what access or authentication the attacker needed. With the key, someone could build counterfeit devices that pass the online authenticity check and sell them to buyers. Recovery phrases and wallet private keys were not exposed.
Como funciona
The Keystone website runs a third-party data monitoring tool. The attacker abused a flaw in it to gain higher privileges, which opened access to customer data and the verification key. The articles do not say where the key was stored. The key matters because of how the check works: the owner scans a QR code on Keystone's verification page, and the QR carries a code in encrypted form. The device decrypts it with its stored key, and the owner types the result into the page. A correct result shows the device holds the key, so anyone holding a copy can produce valid codes and a counterfeit can pass.
Por que é vulnerável
The articles do not describe the flaw in the monitoring tool beyond saying it allowed privilege escalation, so its root cause is unknown. The impact was worse because the authenticity key could be reached from the website environment. The key is also shared across devices and written once at manufacturing into write-once memory, and the firmware refuses a second key. Devices already made therefore cannot be moved to a new key, which is why Keystone will destroy 18,835 unsold units and put a new key on new devices. Separately, Keystone's bulk deletion tool failed unreliably, so data that should have been deleted after 180 days was still held.
Como foi descoberta
Keystone says it found the unauthorized access on October 20 and blocked it the same day. It has not said when the attacker first got in, nor how the intrusion was detected. It first disclosed the breach on October 24, saying a third party had obtained customers' shipping information. On October 26 it published a statement saying the verification key was also taken. It reports no counterfeit devices or thefts so far.
Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 10:16.
Detalhes técnicos
- Keystone found the unauthorized access on October 20 and blocked it the same day. The company has not said when the attacker first got in.
- The attacker exploited a vulnerability in a third-party data monitoring tool used by the Keystone website to escalate privileges, which gave access to customer data and the key. Keystone has since fixed the vulnerability. It has not said where the key was stored.
- Verification flow: the owner scans a QR code on Keystone's verification page, and the QR carries a code in encrypted form. The device decrypts it with its stored key, and the owner enters the result on the page. Anyone with the key could produce valid codes, so a counterfeit device could pass.
- The key is used only for authenticity checks. It plays no part in recovery phrases, private key derivation or transaction signing.
- The key is written once at manufacturing into write-once memory, and the firmware refuses a second key. Devices already made cannot be moved to the new key.
- Exposed data: names, contact details, shipping addresses and order details, held in Shopify, which runs Keystone's online store. Payment card data, bank details, government IDs and Amazon or other channel purchases were not affected.
- Keystone's bulk deletion tool failed unreliably, so data that should have been deleted after the promised 180 days was still held. Retention is now cut to 90 days, and Shopify is expected to purge older data on November 3. The privacy policy still listed 180 days as of October 27.
Remediação
- Devices delivered before October 20 that pass the check can be used normally.
- Devices received after October 20 with the old key: do not use them until Keystone support ([email protected]) confirms they are genuine. The verification page showed no instructions as of October 27, and Keystone has not said how to tell which key a device carries.
- The guidance is based on delivery date, not purchase channel, so it also applies to Amazon and reseller purchases.
- Owners holding crypto on a device do not need to move it solely because of the incident.
- Treat unsolicited refund, replacement, recall, wallet verification or crypto-migration offers as scams. Never enter a recovery phrase into a device you did not order, and type keyst.one manually instead of following links.
Linha do tempo
-
Keystone to destroy 18,835 hardware wallets after attacker steals device verification key via website breach
ler a análise desta fonte ocultar
Keystone disclosed on October 26 that an attacker who gained access to its website obtained the key its hardware wallets use to prove they are genuine. A holder of the key could build counterfeit devices that pass the online authenticity check and sell them to buyers, leading to crypto theft. Keystone will destroy 18,835 unsold devices carrying the key and will issue a new key on all new devices. The same intrusion exposed 25,964 buyer records (2024-2026) plus 12,873 unpaid checkout records. Recovery phrases and wallet private keys were not involved, and Keystone has reported no counterfeit devices or thefts.
Technical Details
- Keystone found the unauthorized access on October 20 and blocked it the same day. The company has not said when the attacker first got in.
- The attacker exploited a vulnerability in a third-party data monitoring tool used by the Keystone website to escalate privileges, which gave access to customer data and the key. Keystone has since fixed the vulnerability. It has not said where the key was stored.
- Verification flow: the owner scans a QR code on Keystone's verification page, and the QR carries a code in encrypted form. The device decrypts it with its stored key, and the owner enters the result on the page. Anyone with the key could produce valid codes, so a counterfeit device could pass.
- The key is used only for authenticity checks. It plays no part in recovery phrases, private key derivation or transaction signing.
- The key is written once at manufacturing into write-once memory, and the firmware refuses a second key. Devices already made cannot be moved to the new key.
- Exposed data: names, contact details, shipping addresses and order details, held in Shopify, which runs Keystone's online store. Payment card data, bank details, government IDs and Amazon or other channel purchases were not affected.
- Keystone's bulk deletion tool failed unreliably, so data that should have been deleted after the promised 180 days was still held. Retention is now cut to 90 days, and Shopify is expected to purge older data on November 3. The privacy policy still listed 180 days as of October 27.
Remediation
- Devices delivered before October 20 that pass the check can be used normally.
- Devices received after October 20 with the old key: do not use them until Keystone support ([email protected]) confirms they are genuine. The verification page showed no instructions as of October 27, and Keystone has not said how to tell which key a device carries.
- The guidance is based on delivery date, not purchase channel, so it also applies to Amazon and reseller purchases.
- Owners holding crypto on a device do not need to move it solely because of the incident.
- Treat unsolicited refund, replacement, recall, wallet verification or crypto-migration offers as scams. Never enter a recovery phrase into a device you did not order, and type keyst.one manually instead of following links.