Keystone Security Breach Exposes 25,964 Customer Records, Compromises Device Authentication Key
Hardware wallet provider Keystone has disclosed a security breach that exposed 25,964 customer records and compromised an authentication key used to verify the authenticity of its devices. The incident, detected on October 20, 2026, prompted the company to suspend outstanding shipments, plan the destruction of 18,835 devices, and introduce additional safeguards for customer data and hardware authentication.
According to Keystone's official statement, the attackers exploited a vulnerability involving a third-party monitoring system to gain unauthorized access to the company's website and Shopify purchase records. The affected records contained information collected between 2024 and 2026.
Keystone Data Breach Affects Thousands of Customer Records
The investigation identified 51,083 buyer records that were accessible during the incident. Of these, 25,964 contained personal information, including customer names, contact details, shipping addresses, and purchase histories. Another 25,119 records had already been anonymized, leaving their associated personal information unavailable during the unauthorized access.
Keystone also identified 12,873 incomplete checkout records containing customer details. The company included these records in its response as a precautionary measure.
The investigation uncovered a separate weakness in Keystone's automated data deletion system. According to the company, failures in the system allowed customer information to remain stored beyond the established retention period, increasing the amount of historical purchase data retained.
Compromised WebAuth Key Triggers Hardware Replacement Plan
Beyond the exposure of customer information, the incident compromised Keystone's WebAuth key, which is used to verify whether its hardware wallet devices are genuine. The company said the compromised credential could allow counterfeit devices to pass authentication checks, creating a potential security risk for customers.
Such a vulnerability could expose users to cryptocurrency theft if they unknowingly relied on counterfeit hardware. However, Keystone confirmed that customers' recovery phrases and private keys were not affected by the breach.
In response, Keystone announced plans to destroy 18,835 existing devices containing the compromised authentication key and replace the affected authentication credentials. The measure is intended to prevent devices relying on the compromised key from continuing to pose an authentication risk.
The company has also suspended outstanding shipments and shifted to a preorder model while awaiting newly manufactured devices. Customers who receive devices after October 20, 2026, that still contain the old authentication key must request additional verification before using them.
Keystone Tightens Data Retention and Customer Verification
Keystone said banking information and government identification numbers were not affected by the incident. The company is also changing its data retention practices to reduce the amount of customer information stored over time.
As part of its response, Keystone has shortened its customer data retention period from 180 days to 90 days and is improving its deletion procedures. These changes address the automated deletion failures identified during the investigation.
Affected customers will receive email notifications about the incident. Keystone also plans to introduce verification services that will enable users to determine whether their information was exposed and check the deletion status of their data.
Keystone Sets Data Deletion Deadline and Plans Further Audits
The company expects overdue purchase records to be deleted by November 3, 2026. It has also submitted regulatory reports across several jurisdictions and plans to conduct additional security audits.
Keystone said it would strengthen its authentication systems to address vulnerabilities identified during the investigation. The company's response covers both the exposed customer records and the compromised device authentication credential, which present distinct risks requiring separate remediation measures.
The incident highlights the importance of protecting customer databases and hardware authentication systems in the cryptocurrency wallet industry. Although Keystone said recovery phrases and private keys remained unaffected, the compromised WebAuth key has prompted a substantial device replacement effort and additional verification requirements.
Writer: Marcus RenfieldCrypto Market Analyst & Onchain WriterMarcus Renfield covers cryptocurrency markets with a focus on onchain data, Bitcoin price action, and emerging market narratives. His writing examines how capital flows, network activity, and broader market structure influence short- and medium-term trends.He aims to provide clear, data-informed analysis for readers seeking a deeper understanding of crypto market dynamics.