Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes

What it is

Keystone, a Bitcoin hardware wallet maker, disclosed on Monday, October 26, 2026 that an attacker obtained its WebAuth key. The company detected the breach on October 20. The key is a secret written into each device at the factory so a page on Keystone's website can confirm the hardware is genuine. It cannot be erased or rewritten. Keystone is destroying its 18,835 unsold units, which carry the compromised key, and has suspended shipping of all unshipped website orders.

How it works

Keystone's statement says an attacker holding the key could produce counterfeit devices that pass its authentication check. Such a device could be sold to a buyer who then loads real funds onto it. The same breach exposed Shopify store records: 51,083 buyer records were involved, 25,119 had already been erased, and 25,964 from 2024 to 2026 still held names, contact details, shipping addresses and order information. These should have been deleted under the 180-day retention policy, but some erasure tasks in the bulk-deletion tool failed and went unnoticed.

Preconditions / Affected

• Keystone says devices delivered before October 20 are unaffected, and that recovery phrases and private keys were not involved.
• Only the Shopify store was affected. Purchases through Amazon and other channels were not.
• The counterfeit risk applies to devices sold after the theft that rely on the website check for authenticity.

What to do

• Treat any message about a "recall", "asset migration", "wallet verification" or "investigation assistance" as a scam. Keystone says it will not ask customers to return their device.
• Customers in the Shopify dataset should expect phishing. The page links exposed names and addresses to wrench attacks (threats or violence to force owners to hand over crypto). Chainalysis counted 46 such attacks in the first half of 2026, with more than $30 million stolen.
• Website sales are now preorders until production of devices with a new key is complete.
• Keystone cut customer data retention from 180 days to 90. On October 24 it asked Shopify to erase all overdue buyer data, a process with a 10-day waiting period, and expects it to finish on November 3, 2026.

Caveats

Keystone has not said who is responsible or when the attacker first got in. The page does not say whether any counterfeit devices already exist. It reports that the company has filed reports with authorities in the EU, UK and other jurisdictions. For comparison, it notes Ledger's 2020 leak reached about 292,000 customers, and that Trezor (13,689 customers) and SafePal (about 39,798) each disclosed customer-data breaches in August 2026.