- Attacker stole Keystone‘s device-authentication key, enabling counterfeit wallets to pass checks.
- Keystone will destroy 18,835 inventory devices and suspend shipments until new keys are available.
- Breach exposed 25,964 customer records and 12,873 incomplete Shopify checkout records.
Hardware wallet maker Keystone disclosed Monday that an attacker who breached its website last week also stole a key used to verify device authenticity. In a statement, the company warned counterfeit wallets could pass its checks: “These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.”
The incident follows attacks on hardware wallet makers this year. Ledger recently asked Southeast Asian and Hong Kong resellers to suspend sales after reports of unauthorized implants, while Coinkite warned users after a bug caused low-entropy wallet seeds and millions in thefts.
Keystone said the attacker exploited a third-party monitoring tool to escalate privileges. The company will destroy 18,835 devices containing the compromised key and pause shipments until new-key production begins.
Devices delivered before Oct. 20 remain safe, but post-incident devices cannot be guaranteed authentic. The company also disclosed that 25,964 buyer records from 2024 to 2026 may have been stolen.
“Some erasure tasks failed, and we did not detect and address these failures in time,” Keystone said of its retention tool. In addition, the attacker may have accessed 12,873 incomplete checkout records held by Shopify.
The breach echoes a June 2020 Ledger incident that exposed over 1 million email addresses. Other hardware wallet makers, including Trezor and SafePal, also reported third-party data exposures this year.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
