Keystone has revealed that a security breach on their website led to unauthorized access to a key used to verify their hardware wallets' authenticity. An attacker exploited a vulnerability in a third-party monitoring tool, enabling access to customer data and the critical verification key. This breach prompted Keystone to destroy 18,835 unsold devices to prevent potential exploitation through counterfeit wallets, although no actual counterfeit devices have been detected so far. Importantly, the breach did not compromise recovery phrases or private keys, safeguarding the core security of existing wallets.

The company discovered the breach on October 20 and quickly blocked further unauthorized access while addressing the vulnerability. For devices received after this date, Keystone advises customers to verify authenticity by contacting their support team. Devices delivered before October 20 that pass the verification check remain considered genuine. The compromised key, stored during manufacturing and unalterable post-production, is only used for the verification process. Keystone has reassured users that it plays no role in generating recovery phrases or signing transactions.

In addition to the verification key issue, the breach exposed personal data from 25,964 customer records obtained from purchases on Keystone's website between 2024 and 2026. This data includes names, contact details, and shipping addresses. Fortunately, payment information and government IDs were not affected. Keystone's response includes reducing the retention period for personal data from 180 days to 90 days and requesting Shopify to comply with this change by November 3. An automated tool intended for mass deletion of records failed, contributing to the oversight in data management.