Keystone to destroy 18,835 wallets after WebAuth authenticity key breach

Key Facts

Keystone said it will destroy 18,835 wallet devices in its inventory after attackers obtained the WebAuth key used to verify device authenticity. The company announced the measure on October 26, following the detection of unauthorized access to its official website on October 20, 2026. It said the access resulted from the exploitation of a vulnerability in a third-party data monitoring tool. It also halted shipments of unfulfilled orders. The incident combines a risk involving the device verification key with a data retention problem affecting some buyers.

On the data side, the investigation identified 51,083 purchase records linked to the company’s Shopify store. Personal data had been deleted from 25,119 records before the attack, while it remained in 25,964 records. The remaining records include customers’ names, contact details, shipping addresses and order details. The purchases covered by them date from 2024 to 2026. These are counts of records covered by the investigation, not a tally of unique customers.

Investigators also identified 12,873 incomplete payment records containing information submitted by people who did not complete checkout. Keystone attributed the persistence of some data to a failure by the automated deletion tool to remove records within the previous 180-day retention period. The issue therefore affected data linked to both completed purchases and transactions that did not reach payment. The company said the records included personal information, including contact, shipping and order details in the purchase records that remained stored. The source did not say that the number of these records represented the same number of people affected.

As for the WebAuth key, the company said it is embedded in devices during manufacturing and cannot be erased or rewritten once installed. Possession of the key could enable counterfeit devices to be made that pass authenticity checks, according to information published about the breach. Keystone therefore decided to destroy all devices in its inventory carrying the compromised key, totaling 18,835 devices. The source did not report that counterfeit devices had been found or actually manufactured. The announced measure focused on devices that had not been shipped, and the company halted dispatch of unfulfilled orders.

Regarding users’ assets, Keystone said recovery phrases, private keys, wallet credentials and banking information were not compromised. This means the data the company said was affected included personal information linked to purchases, while it denied that wallet access keys or funds were compromised. It also said devices delivered before October 20 can be used if they pass an authenticity check. Those who received their devices after that date should request additional verification from the support team. The company made October 20 the cutoff date in its guidance to users on checking devices.

Keystone’s official page describes its device verification process, which involves scanning a QR code, entering a verification code and then viewing the result; the company recommends checking a new device upon receipt and before using it. On wallet buyer data retention policies, Trezor says shipping data linked to a purchase is deleted or anonymized after 90 days. The company explained that this period covers delivery, returns, refunds or replacements. Keystone’s previous retention period was 180 days, but the automated deletion tool failed to apply it to some records. The difference in the periods provides direct context for the retention policy Keystone had in place.

The incident comes amid a series of events involving data at digital wallet companies and their suppliers. In August 2026, EL7.AI published a story about a data leak affecting 40,000 SafePal customers due to a flaw in a third-party plugin. In an update issued in September, Trezor said an incident at email provider Brevo led to the export of 347,149 addresses from its marketing contact list. These incidents add context to the risks of customer data exposure through third-party tools or providers, a point related to the cause of the access disclosed by Keystone. The source did not specify when the device destruction or deletion requests would be completed.