INTEL: Keystone wallet breach exposes authentication key and 25,964 buyer records

Cryptocurrency hardware wallet manufacturer Keystone has disclosed that a security breach exposed personal information from 25,964 buyer records and compromised a key used to verify whether its devices are genuine.

In a detailed statement dated October 26, 2026, the company said the stolen authentication key could allow counterfeit hardware wallets to pass its official authenticity checks.

Keystone has suspended shipments from its website and plans to destroy 18,835 devices in existing inventory that contain the compromised key.

The company maintains that wallet recovery phrases, private keys and transaction signing systems were not affected.

Stolen authentication key creates counterfeit wallet risk

Keystone said attackers obtained its WebAuth key, which is embedded into hardware wallets during manufacturing and used to verify device authenticity.

Unlike a wallet’s private keys, the WebAuth key does not control cryptocurrency funds or authorize transactions.

However, its exposure potentially allows attackers to manufacture counterfeit devices capable of passing Keystone’s official authentication process.

According to the company, customers who unknowingly purchase and use counterfeit devices could face cryptocurrency theft.

Keystone said the old authentication key cannot be removed or rewritten on devices that already contain it.

As a result, the manufacturer will destroy 18,835 unsold devices, introduce a new authentication key for future production and suspend existing website shipments until replacement inventory becomes available.

Personal information exposed in nearly 26,000 buyer records

Keystone’s investigation identified 51,083 buyer records associated with purchases through its Shopify-powered online store.

The company said 25,119 records had already been anonymized before the incident.

The remaining 25,964 contained personal information, including customer names, contact details, shipping addresses and order information from purchases made between 2024 and 2026.

Investigators also identified 12,873 incomplete checkout records that contained customer information, although some entries may have been incomplete or inaccurate.

Keystone acknowledged that its automated data deletion system had failed to reliably remove information after the company’s previously established 180-day retention period.

The company said it failed to detect these errors, allowing older customer records to remain accessible beyond its stated policy.

It has since shortened its retention period to 90 days and submitted requests to erase overdue customer records.

The company expects the relevant deletion requests to be completed by November 3.

Website vulnerability enabled unauthorized access

Keystone said it detected unusual access to its official website on October 20.

Its investigation identified a vulnerability involving a third-party data monitoring tool, which the attacker allegedly exploited to gain elevated privileges.

The company said it blocked the unauthorized access, fixed the vulnerability and launched a forensic investigation.

The breach was initially disclosed publicly on October 24, when Keystone confirmed that customer information had been accessed.

The October 26 statement provides additional details, including the scale of the affected records and the compromise of the device authentication mechanism.

What Keystone customers should do

Keystone says devices delivered before October 20 remain unaffected by the authentication compromise and can continue to be used normally if they pass the company’s verification process.

Customers receiving devices after October 20 that use the old authentication key should contact Keystone support for additional verification, even if the device passes an automated authenticity check.

The company warned that attackers could impersonate support representatives and request wallet recovery phrases or arrange fraudulent device recalls.

Keystone says customers do not need to transfer their assets solely because of this incident and should not send devices to anyone claiming to conduct a recall.

Affected customers are being contacted individually, and the company plans to introduce online tools for checking whether personal information was exposed or deleted.

Keystone has also submitted regulatory notifications in the European Union, United Kingdom and other jurisdictions.

The incident highlights two separate risks: exposure of customer identity information and the compromise of a device authentication system that could allow counterfeit hardware wallets to appear genuine.