The key that proves a wallet is genuine was stolen

Hardware wallet maker Keystone says the attacker who breached its website last week also stole a key used to verify the authenticity of its devices, widening an incident first disclosed as a customer data leak. In a statement on Monday the company said the key could allow attackers to produce counterfeit wallets that pass its authenticity checks.

These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.

Keystone says the attacker exploited a vulnerability in a third-party monitoring tool used by its website to escalate privileges, which gave access to some customer information and to the authentication key. It plans to destroy 18,835 devices in its inventory that contain the compromised key and has suspended shipments of all devices using it until it produces units with a new one. Devices manufactured and delivered before the 20 October incident should be considered safe; for devices delivered after that date it cannot guarantee authenticity and asks customers to contact support.

The customer-data side has a failure of its own. The website's Shopify store had generated 51,083 buyer records, of which 25,119 were deleted under a 180-day retention policy. The remaining 25,964, dating from 2024 to 2026, may have been stolen because the automated bulk-erasure tool did not run reliably, and the attacker may also have reached 12,873 checkout records for purchases that were never completed.

The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period.

It is the latest in a run of attacks on hardware wallet makers this year. Earlier this month Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales after reports of devices carrying implants that captured recovery phrases, and in late July Coinkite warned users after a bug left some Coldcard devices generating seeds with less entropy than intended.