Keystone to Destroy 18,835 Wallets After Attacker Steals Authenticity Key
Keystone confirmed that an attacker accessed its official Shopify store and stole the key its hardware wallets use to prove authenticity, allowing counterfeit devices to pass the official verification; the company will destroy 18,835 unsold wallets. Names, contact details, addresses and order information of 25,964 buyers were exposed because the promised 180-day data deletion tool did not operate reliably. Recovery phrases and private keys were not affected, but the company warns of fake Keystone support scams.
What happened
Keystone, a hardware wallet maker, said an attacker accessed its official Shopify store and obtained customer shipping data. The attacker also stole the key used to prove the wallets are genuine. As a result, the company will destroy 18,835 unsold devices.
Why it matters
Names, contact details, addresses and order information of 25,964 buyers were exposed, some from 2024, because the promised 180-day data deletion tool did not operate reliably. With the stolen key, anyone can build counterfeit wallets that pass Keystone's own verification, and a buyer who trusts a fake could have crypto stolen. Payment cards, bank details, recovery phrases and private keys were not exposed, but a wave of fake support scams is expected.
What to do
Ignore any Keystone support contact by phone, text, email or mail offering refunds, replacement devices or order fixes, and never share a recovery phrase. Keystone has blocked access, fixed the vulnerability and is emailing affected customers. Buy only through official channels.
For the technical team
- Affected
- Loja oficial online da Keystone Wallet (Shopify) · Customers of Keystone's official store: 25,964 buyer records with names, contact details, shipping addresses, items and prices, some from 2024. 18,835 unsold wallets will be destroyed because of the stolen key.
- Exploitation
- No fraud involving counterfeit devices has been reported so far. The company and Cointelegraph warn that scammers may pose as Keystone support by phone, text, email or mail. The key theft was reported by Keystone itself and by The Hacker News.
- Fix
- Keystone says it blocked access and fixed the vulnerability; it opened an investigation and promised a detailed report. The authenticity key cannot be replaced in already-manufactured devices, which motivated destroying the 18,835 unsold units.
- Vector
- Unauthorized access to Keystone's official website, a Shopify-hosted store, detected on October 20 and confirmed on October 23 by reviewing API activity with Shopify. The attacker obtained shipping data and the device verification key. The buyer data deletion tool, promised after 180 days, did not operate reliably.
- More details
- Timeline: detection on October 20, breach confirmation on October 23, statement on October 26. Not exposed: payment cards, bank details, recovery phrases, private keys and wallet passwords. According to Coin Bureau, this is the fourth hardware wallet maker breached in 2026, after Ledger (January, via Global-e), Trezor (August, nearly 80,000 customers, via a shipping partner) and SafePal (August, 39,798 customers, via an order-tracking plug-in); Trezor had another incident in September, with fake security alerts to about 347,000 newsletter subscribers. Official contact channel: support@keyst.one.
Timeline
Further report details that the stolen key could let counterfeit wallets pass Keystone's official authenticity check, exposing users to cryptocurrency theft, and cannot be replaced on already-manufactured devices, prompting the destruction of 18,835 unsold units.
Company says the attacker accessed its website and obtained the key wallets use to prove they are genuine, allowing counterfeit devices to pass the online check.
New detail: beyond the device verification key, the breach affected 25,964 buyer records.
Want the next updates in your inbox? Get the daily edition →
See all 7 updates
Social media post reiterates the breach Keystone suffered.
Keystone says the intruder also stole the wallet authenticity key and will destroy 18,835 unsold devices; 25,964 buyer records were exposed.
Keystone details the website breach: names, contact details, home addresses and order info; keys and seed phrases were not touched, but the company warns of fake 'Keystone support' scams. It is the fourth hardware wallet maker hit this year, after Ledger and Trezor.
Wallet maker Keystone confirms unauthorized access to its official store and a shipping data leak.
Sources 8 sources
- @KeystoneWallet @KeystoneWallet
- @coinbureau @coinbureau
- @Cointelegraph @Cointelegraph
- @IntCyberDigest @IntCyberDigest
- @AndrewCurran_ @AndrewCurran_
See all 8 sources
- @TheHackersNews @TheHackersNews
- Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key The Hacker News
- @DarkWebInformer @DarkWebInformer
