Keystone to destroy 18,835 unsold devices after authenticity verification key exposed
Key Facts
Keystone plans to destroy 18,835 unsold hardware wallets in its inventory after a breach of its website exposed a key embedded in the devices that could allow counterfeits to pass online authenticity checks. CoinDesk reported the details on Oct. 27, 2026, citing the company as saying the attacker accessed the website on Oct. 20. The incident has put the mechanism for verifying that a device is genuine under scrutiny and raised questions about the store’s customer data. Keystone confirmed that the devices it will destroy remain unsold inventory. The report did not say the company had disabled customers’ wallets or decided to destroy devices previously sold.
According to CoinDesk, the attacker accessed the company’s website through a vulnerability in a third-party data-monitoring tool. The exposed information included the verification key Keystone uses to prove its devices are authentic, as well as customers’ personal data. The company said the key is embedded in devices during production and cannot be changed afterward. Possession of it allows counterfeit devices to pass online authenticity checks, prompting the company to dispose of inventory that may contain the exposed key. The breach therefore extended from website data to the reliability of device verification, although, according to the company, it did not extend to the wallet keys that hold users’ assets.
The attack exposed 25,964 records of buyers from 2024 to 2026, including their names, contact details, shipping addresses and order information. The report said an additional 12,873 records of incomplete payments may have been affected by the breach. These figures show that the incident involved store data and purchase transactions, as well as the verification key embedded in the devices. Keystone said recovery phrases, private keys and wallet credentials were not disclosed. The company thus distinguished between information affected on its website and authentication data that provides access to wallets or their assets.
The breach renewed attention to how the company retained customer records. The report said some records should have been deleted under a 180-day retention policy, but the automated deletion tool failed to remove them. Keystone did not detect the failure when it occurred, according to CoinDesk. That means records kept beyond the specified period remained among the data that could be affected when the website was breached. After the incident, the company announced it would reduce the data retention period to 90 days. It also said it would replace the verification key in new devices, in a response aimed at addressing the source of the risk in devices produced later.
Keystone said devices customers received before Oct. 20 remain safe to use if they pass the authenticity check. Those who received devices using the old key after that date should request additional checks before using them. The guidance makes the date the attacker accessed the website an important cutoff for users, without implying that every device delivered afterward was tampered with. At the same time, the company said users do not need to move their funds solely because of the breach. It warned of fake recall or asset-transfer messages, amid the possibility that the incident could be exploited to push customers into unnecessary steps.
Alongside replacing the key and shortening the retention period for customer records, Keystone said it would move sales on its website to a preorder system. The report did not specify when the change would take effect, but linked it to the company’s measures following the breach. The step also targets sales of new devices as the company disposes of 18,835 unsold devices. Customers who received a device using the old key after Oct. 20 still need to request additional checks before use, while the company said older devices remain safe if they pass verification. It also stressed that users should not move funds solely because of the breach and should be wary of fake recall or asset-transfer messages.