Keystone Breach Deepens as Hackers Steal Key Used to Verify Genuine Crypto Wallets

Cryptocurrency hardware wallet maker Keystone has disclosed a serious expansion of its recent security breach. Hackers stole a critical authentication key that could allow counterfeit devices to pass official verification checks.

The company revealed the additional security threat on October 26, 2026, after initially reporting the exposure of customer information. Keystone now plans to destroy 18,835 hardware wallets and suspend pending shipments while introducing stronger authentication safeguards.

Hackers Compromise Critical Wallet Authentication Key

Keystone detected unauthorized access to its official website on October 20. Investigators later determined that attackers exploited a vulnerability in a third-party data monitoring tool, allowing them to gain elevated access privileges.

The attackers obtained Keystone’s WebAuth key, which verifies whether hardware wallets are genuine. Manufacturers embed this key during production, making it impossible to erase or replace on existing devices.

Consequently, criminals could potentially manufacture counterfeit wallets capable of passing Keystone’s official authentication process. Such devices could expose unsuspecting cryptocurrency investors to asset theft.

However, Keystone emphasized that the stolen authentication key does not generate recovery phrases, derive private keys, or authorize cryptocurrency transactions. The company has not confirmed any instances of counterfeit devices exploiting the compromised key.

Keystone to Destroy 18,835 Hardware Wallets

Following the discovery, Keystone announced plans to destroy 18,835 devices containing the compromised authentication key. The company has also suspended shipments of outstanding website orders until replacement devices become available.

Newly manufactured wallets will use a different authentication key. Meanwhile, Keystone has shifted its website sales toward preorders as it prepares replacement inventory.

The investigation also revealed that hackers accessed personal information associated with 25,964 customer purchase records. Additionally, Keystone identified 12,873 incomplete checkout records that potentially contained sensitive customer details.

Exposed information included names, contact details, shipping addresses, and purchase histories. Keystone acknowledged that failures in its automated deletion system had allowed some customer information to remain stored longer than intended.

Customers Warned About Counterfeit Devices and Scams

Keystone said wallets delivered before October 20 remain trustworthy if they pass authentication checks. However, customers who received devices containing the older key after that date should contact official support for additional verification.

The company also warned users about fraudulent recall notices, replacement offers, and requests to transfer cryptocurrency assets. Keystone stressed that it would never ask customers to surrender recovery phrases or return devices through unsolicited recall requests.

Although private keys and recovery phrases were not compromised, the incident highlights security risks beyond cryptocurrency storage technology. For hardware wallet manufacturers, protecting customer information and device authentication systems remains essential to maintaining investor confidence.