Keystone Said Private Keys Were Never Touched. They Didn't Mention the Other Key — the One That Proves the Wallet Isn't Fake.
A breach at hardware-wallet maker Keystone started like the usual Shopify data leak. Six days later, the company admitted hackers also stole the factory-burned key its own anti-counterfeit check relies on — forcing it to destroy 18,835 unsold devices.
CVE Tools4 min read
Keystone's first statement, on October 24, 2026, was reassuring in the way these statements always are: a third party got into the website, pulled customer shipping records, but "payment card information, bank details, wallet recovery phrases, private keys and passwords were not compromised." That sentence is true. It is also not the whole story. Two days later Keystone admitted the attacker also stole the WebAuth key — a different kind of key, burned into every device at the factory, that exists for one job: letting a buyer confirm their hardware wallet isn't counterfeit. Because that key can't be rewritten on hardware that's already been manufactured, Keystone is now destroying 18,835 unsold wallets and telling some customers that even a device which passes its own authenticity check can't be fully trusted.
How the story changed in six days
Keystone's disclosure, in order
- Unauthorized access detectedKeystone's monitoring flags unusual activity on its official website.
- Breach confirmed with ShopifyReviewing API activity with Shopify, Keystone confirms a third party obtained customer order data.
- First public disclosureKeystone discloses names, contact details, shipping addresses and order details were exposed. States recovery phrases, private keys and passwords were not touched.
- Scope escalates: the WebAuth keyKeystone discloses the attacker also obtained the factory-burned WebAuth key used by its device-authenticity check, and that it exploited a vulnerability in a third-party monitoring tool to escalate privileges. Buyer-record scope clarified: 51,083 total, 25,964 with personal data.
- Remediation updateRetention cut from 180 to 90 days, all shipments suspended, partner warehouses (including Amazon) told to isolate affected inventory.
Why a stolen "authenticity" key is worse than a stolen password
Keystone's open-source firmware ties device verification to a key written into the chip at manufacturing time. The owner scans a QR code on Keystone's verification page; the device decrypts an embedded challenge with its stored key and displays a code back. A matching code is supposed to prove the hardware is genuine Keystone, not a tampered or counterfeit unit slipped into the supply chain — the exact threat hardware-wallet buyers are trying to avoid by not trusting a software wallet.
| Device status | Keystone's guidance |
|---|---|
| Delivered before Oct 20, 2026 | Passes authentication → can be treated as genuine and used normally. |
| Received after Oct 20, 2026, carries old key | Even if it passes authentication, Keystone says it "cannot completely rule out the possibility that it is counterfeit." Contact support@keyst.one before using it. |
| Ordered now | Held as preorder until new-key stock ships — Keystone estimated 4–6 weeks. |
Keystone has not published a way for an owner to tell, from the device itself, which key generation it carries — the guidance runs entirely on delivery date and a support-desk lookup.
The fourth hardware-wallet vendor breach of 2026
Keystone is not an outlier this year, it's the third name in a pattern. Trezor disclosed a breach via its shipping partner ShipMonk in August (initially ~14,000 customers, later revised to 81,000 after ShipMonk failed to delete data as contractually required), then a second, separate breach of its email provider weeks later. SafePal disclosed in mid-August that an authorization flaw in an order-tracking plug-in let one customer's order number pull up another's shipping and purchase data — 39,798 records, for orders stretching back to March 2025 because a cleanup job had silently broken. None of the three — Trezor, SafePal, Keystone — reported private keys, recovery phrases or wallet passwords exposed. All three named a different root cause: a logistics vendor, a tracking plug-in, and a monitoring-tool privilege-escalation bug, respectively.
| Label | Value |
|---|---|
| Trezor (Aug, expanded) | 81000 |
| SafePal (Aug) | 39798 |
| Keystone (Oct, w/ personal data) | 25964 |
What leaked vs. what stayed off-limits, across all three
- Names, emails, phone numbers
- Shipping addresses
- Order/purchase details
- Keystone only: the WebAuth device-authenticity key
- Recovery phrases / seed words
- Private keys
- Wallet passwords
- Payment card and bank details
Why a home address is not a small thing to leak
A leaked address tied to a known crypto-hardware purchase is a target list for physical coercion, not just phishing. CertiK's Intel3D Wrench Attacks report counted 52 verified "wrench attacks" worldwide in H1 2026 — up 33% from 39 in H1 2025 — with recorded financial exposure jumping from $10.5M to $124.1M, and home invasions overtaking robbery as the most common form. Europe, and France specifically (33 of the 52 cases), dominates the dataset.
If you own a Keystone device
- Never enter your recovery phrase into any device, page, or person — this breach doesn't change that rule, and neither does any message claiming to need it to "verify" your wallet.
- If your device arrived after October 20, 2026 and still carries the old WebAuth key, email support@keyst.one before relying on it — a passing authenticity check is not currently sufficient proof on its own.
- Treat unsolicited "refund," "replacement device," or "recall" contact as phishing by default; Keystone has already flagged this as the expected follow-on scam.
- If you ordered more than 90 days ago, you can now request Keystone delete your shipping data rather than wait out the retention window.
Facts current as of 2026-10-30live record →
Keystone has not disclosed the exact mechanism of the "third-party data monitoring tool" privilege-escalation bug, nor whether it has evidence of counterfeit devices actually built with the stolen key. Keep watching /trends for how this and other vendor-breach patterns develop, and if you track third-party and supply-chain exposure as part of your own stack, My Stack is built for exactly that kind of monitoring.
Sources: Keystone Hardware Wallet — Oct 24 statement, Keystone Hardware Wallet — Oct 26 statement on the WebAuth key and device guidance, CertiK Intel3D H1 2026 Wrench Attacks Report.