Keystone Breach Widens as Attacker Grabs Its Device Authentication Key

What it is

Keystone, a hardware wallet maker, said on 26 October 2026 that the attacker behind its 20 October breach also took the WebAuth key. Devices use this key to prove they are genuine. It is written at the factory and cannot be changed. Keystone is scrapping the 18,835 wallets in inventory that carry it. New units will get a fresh key. Website orders are on hold in favor of preorders until that batch is ready.

How it works

The attacker got in through a flaw in an unnamed third-party monitoring tool on Keystone's Shopify-based site. The WebAuth key plays no part in creating seeds or signing transactions. The risk is that someone holding it could make fake devices pass Keystone's own authenticity check.

Preconditions / Affected

• Exposed: 25,964 buyer records from 2024 to 2026 (names, contact info, addresses, order details). Keystone also counts 12,873 unpaid checkout records as a precaution.
• Keystone says seeds, private keys, bank payment info and government IDs are safe. Amazon sales were not affected.
• Keystone had advertised deleting shipping data within 180 days. Some tasks in its automated erasure tool failed and went unnoticed, so older orders were exposed. Customers flagged this over the weekend, as The Block reported. Retention is being cut to 90 days.

What to do

• A device delivered before 20 October that passes authentication is genuine, according to Keystone.
• A device with the old key received after 20 October may be counterfeit even if the check passes. Keystone says it "cannot completely rule out the possibility that it is counterfeit." Owners should contact support for extra verification before using it.
• Keystone says it will not ask anyone to return a device. Any "recall" request is a scam, as are offers to migrate assets or verify a wallet.
• Buyers whose details were exposed should expect targeted phishing that uses their order data. This follows from the leaked fields, and the page does not say it.

Caveats

The page does not name the monitoring tool or say whether the flaw is fixed. It does not describe how the key was extracted, or whether any counterfeit units have been seen. The Bankless commentary is an opinion: attackers are mostly leaving the secure chip alone and targeting the systems around it.