Keystone to Destroy 18,835 Hardware Wallets After Website Breach Exposes Customer Data
Cryptocurrency hardware wallet manufacturer Keystone will destroy 18,835 unsold devices and suspend shipments after a website security breach exposed customer information and a production key that could allow counterfeit wallets to pass authenticity checks.
The company disclosed the incident in a post on X on Monday, saying an attacker accessed its website on October 20 by exploiting a vulnerability in a third-party data monitoring tool. The breach exposed 25,964 buyer records covering the period from 2024 through 2026. The compromised information included customer names, contact details, shipping addresses and order information. A further 12,873 records associated with unpaid checkout sessions may also have been affected.
Keystone said the incident did not expose customers' recovery phrases, private keys or wallet credentials. However, the exposure of a key embedded in devices during manufacturing has raised a separate concern about the ability to verify whether a wallet is genuine.
Keystone Breach Raises Hardware Wallet Authenticity Concerns
According to Keystone, the compromised key is built into devices during production and cannot be changed. It enables wallets to pass online authenticity checks, meaning unauthorized parties could potentially use the exposed key to make counterfeit devices appear legitimate.
To address the risk, Keystone said it would destroy 18,835 unsold units and suspend shipments. The company also advised customers to distinguish between devices that remain verifiable and those that may require additional checks before use.
Keystone said devices delivered before October 20 remain safe to use if they pass authentication checks. Customers who received devices using the old key after that date should seek further verification before using them.
The company added that customers do not need to transfer their cryptocurrency holdings solely because of the breach. It also warned users to be cautious of fraudulent recall notices or messages urging them to migrate their assets.
Failed Data Deletion Process Contributed to Exposure
The incident also revealed shortcomings in Keystone's handling of stored customer information. The company said some records should already have been removed under its 180-day data retention policy, but an automated deletion tool failed without the issue being detected.
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.
The disclosure highlights how security risks can extend beyond the protection of wallet credentials to include personal information retained by companies serving cryptocurrency users. Exposed names, contact details and delivery addresses can create opportunities for targeted phishing and other scams, although Keystone's disclosure did not establish that such activity had occurred as a result of this incident.
Foundation Reports Separate Hardware Wallet-Related Breach
Keystone's announcement followed a separate disclosure by hardware wallet manufacturer Foundation, which reported that attackers had sent phishing emails designed to appear as though they originated from the company's official domains.
Foundation said it had identified more than 23,000 phishing email attempts. The company reported no evidence that its Passport devices or private keys had been compromised.
Foundation also discovered older database copies that had not been captured by its 60-day data deletion process. The company said attackers could access records containing approximately 5,600 mailing addresses and 5,200 phone numbers, although it could not confirm how many records had actually been accessed.
Hardware Wallet Security Remains a Key Concern
The Keystone and Foundation disclosures add to a series of security incidents affecting hardware wallet users this year. In one incident involving Ledger, criminals reportedly modified devices sold through resellers in Southeast Asia with concealed components designed to capture recovery phrases during setup.
Another incident involving Coldcard concerned a vulnerability in seed-generation software that reportedly allowed attackers to reconstruct private keys and drain cryptocurrency wallets remotely.
These cases involve different attack methods, ranging from compromised customer databases and phishing campaigns to device tampering and software vulnerabilities. The Keystone incident is distinct because the company identified a production key that could undermine online authenticity checks, prompting it to destroy thousands of unsold devices.
Keystone's guidance remains that customers do not need to move funds because of the breach alone. Users who received potentially affected devices after October 20 should seek additional verification, while remaining alert to fraudulent communications that exploit the incident to solicit recovery phrases or encourage asset transfers.
source: coindesk
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.