Hardware wallet manufacturer Keystone has halted direct product shipments and destroyed 18,835 unsold units after attackers breached its e-commerce infrastructure and stole an internal root authentication key used to verify device authenticity.
The breach, detected Oct. 20, exposed customer order and shipping records stored in the company’s Shopify backend, affecting more than 38,000 buyers. While Keystone confirmed that on-device private keys, recovery seed phrases and on-chain crypto assets were not compromised, the theft of its manufacturing WebAuth key enables malicious actors to fabricate counterfeit hardware capable of passing official verification checks. (Read More: Beginner Wallet-Security Checklist)
The incident escalated Oct. 26 when Keystone confirmed intruders had obtained the official WebAuth root authentication key during the intrusion. Because authentication credentials are permanently burned into the physical secure hardware during factory assembly and cannot be modified remotely, Keystone destroyed its entire inventory of 18,835 warehouse units. The company paused direct fulfillment, switched upcoming orders to a pre-order model and shifted production to a newly issued replacement key.
Attackers extracted more than 25,000 completed purchase records and roughly 13,000 incomplete checkout entries. Leaked customer information includes full names, delivery addresses, telephone numbers, email addresses and order contents. Keystone stated that payment card information was not compromised.
The leak also revealed an internal compliance failure involving customer data retention. Although Keystone previously pledged to wipe customer order histories after 180 days, customers who made purchases more than two years ago received breach notices. The company acknowledged that its automated deletion pipeline had malfunctioned and said it has since shortened its data retention window to 90 days.
Keystone advised existing owners not to panic-move assets, noting that existing air-gapped devices and recovery phrases remain secure. However, the exposure of physical home addresses and phone numbers creates severe risks of targeted physical extortion, bogus postal mailings and impersonation scams. Keystone warned users against acquiring hardware from third-party resellers until devices with the new root authentication certificates enter circulation.
The Keystone crisis follows another major hardware wallet security incident earlier this month involving industry leader Ledger. In mid-October 2026, Ledger asked distributors across Southeast Asia to suspend retail sales after researchers discovered unauthorized hardware implants inside devices sold by Malaysian reseller CryptoBilis, a supply-chain tampering campaign linked to over $86 million in stolen digital assets. (Read More: Ledger Extends Regional Retail Freeze Across SEA and Hong Kong as Teardowns Find Spy Implants Beyond CryptoBilis)
Hardware wallet buyers have repeatedly faced post-purchase exposure through vendor databases. Ledger suffered an e-commerce breach in 2020 that exposed the residential addresses and phone numbers of roughly 272,000 buyers, leading to years of targeted phishing attacks and physical extortion schemes. (Read More: Ledger Users Targeted by Phishing Scams Following Global-e Data Breach)
Disclosure: AI is used to assist in developing this article.
This article is published on BitPinas: Keystone Hardware Wallet Halts Sales, Destroys 18,835 Devices Following Customer Data Breach
What else is happening in Crypto Philippines and beyond:
No Comment! Be the first one.