Crypto wallet maker Keystone to destroy almost 19,000 devices after security breach

What it is

Keystone, a hardware wallet maker, said on X on 27 October 2026 that it will destroy 18,835 unsold devices and suspend shipments. An attacker entered its website on 20 October 2026 through a flaw in a third-party data monitoring tool. The page does not name the tool.

Preconditions / Affected

• Exposed: 25,964 buyer records from 2024 through 2026 (names, contact details, shipping addresses, order information). Another 12,873 unpaid checkout records may also be affected.
• The stolen key is set in each device during production and cannot be changed. It lets a wallet pass online authenticity checks, so a counterfeit device could look genuine.
• Keystone says recovery phrases, private keys and wallet credentials were not exposed.
• Some records were held past the 180-day retention policy because an automated deletion tool failed and the company did not notice.

What to do

Keystone's guidance for owners:

• Devices delivered before 20 October 2026 remain safe to use if they pass authentication.
• Devices delivered after that date with the old key need further checks before use. The page does not say what those checks are.
• Moving funds is not required because of this breach alone.
• Ignore fake recall or asset-migration messages. Buyers in the leaked records are plausible phishing targets.

Keystone's own changes: a new authentication key in new devices, website sales switched to preorders, and customer data retention cut to 90 days.

Caveats

The page does not say whether the key is already being abused or how counterfeit units would be detected beyond the authentication check.

Foundation disclosed a separate breach the day before. Attackers sent phishing emails that appeared to come from its official domains, and Foundation counted over 23,000 attempts. It found no evidence that Passport devices or private keys were compromised. Older database copies had escaped its 60-day deletion process. Records with about 5,600 mailing addresses and 5,200 phone numbers were accessible, though Foundation could not confirm how many were accessed.

The page also cites two earlier attacks this year. At Ledger, devices sold through resellers in Southeast Asia were fitted with hidden components that captured recovery phrases during setup. A flaw in Coldcard's seed-generation software let attackers reconstruct private keys and drain wallets remotely.