Keystone Is Destroying 18,835 Hardware Wallets After Hackers Stole Its Device Verification Key

In brief

• Keystone will destroy 18,835 hardware wallets after hackers stole the key that proves a device is genuine. If you own one, check when it arrived before using it.
• An attacker reached Keystone’s website on October 20, 2026 through a flaw in a third-party data monitoring tool, then escalated privileges and took customer data plus the device verification key. Keystone blocked the access the same day.
• The breach exposed 25,964 buyer records from 2024 through 2026 — names, contact details, shipping addresses, and order information — plus 12,873 unpaid checkout records held as a precaution. Recovery phrases, private keys, and wallet credentials were not exposed.
• The stolen key is burned into devices during manufacturing and cannot be changed, which is why unsold units carrying it must be destroyed rather than patched. New devices will carry a new key.
• Owners whose device was delivered before October 20 and passes the authenticity check can use it normally, Keystone says. Owners who received a device after that date with the old key should contact Keystone support and not use it until the company confirms it is genuine.
• Keystone says owners do not need to move funds because of the breach alone — but it warns against fake recall, refund, and asset-migration messages, which are exactly the scams this breach sets up.

What actually happened?

A hardware wallet’s whole promise is that your crypto keys never leave the device. The Keystone breach does not break that promise directly — no private keys or recovery phrases were taken — but it breaks something almost as important: the way you prove the device in your hand is really a Keystone.

Here is the sequence as Keystone disclosed it. An attacker gained access to the company’s website on October 20, 2026, exploiting a vulnerability in a third-party data monitoring tool used on the site, then escalated privileges. From there the attacker obtained customer data and the key that Keystone hardware wallets use to prove they are genuine. Keystone blocked the attacker’s access on October 20 and says it has since fixed the vulnerability. The company first disclosed a breach on October 24, saying a third party had obtained customers’ shipping information, and gave the fuller account — including the stolen key — in a statement on October 26.

The response is unusually physical for a website breach. Keystone will destroy 18,835 unsold devices that carry the compromised key, suspend shipments until devices with the new key are ready, and shift website sales to preorders. Destroying hardware is the only option here, and understanding why is the key to understanding the whole incident.

What does the verification key actually prove?

When you buy a hardware wallet, one of your first jobs is to check that it is genuine and not a tampered or counterfeit unit. Keystone’s check works like this: the owner scans a QR code on Keystone’s verification page with the device, then enters the code the device displays back on the page. In Keystone’s open-source firmware, the QR code carries that code in encrypted form, and the device decrypts it with its stored key. A correct code shows the device holds the key.

That key plays a narrow role, and the narrowness matters. It is used only for this authenticity check. It plays no part in creating recovery phrases, deriving private keys, or signing transactions. So a thief holding the key cannot drain your wallet from afar, and cannot reconstruct your keys. What the thief can do is build a counterfeit device that passes the check — the one test buyers rely on to tell a real Keystone from a fake one.

A buyer who trusted such a counterfeit could have their crypto stolen, because a fake device can be built to leak its recovery phrase or keys during setup. Keystone has not reported any counterfeit devices or thefts. The destruction of 18,835 units is preventive: every unsold device carrying the old key is now a device whose authenticity check can be faked, so none of them can be sold as trustworthy.

Why can’t the old devices just be patched?

Because the key is written into each device during manufacturing and cannot be erased or rewritten. The firmware keeps it in memory that can be written only once, and refuses to accept a second key. Devices already made cannot be switched to the new key, no matter what software update ships.

That is why the company’s options were binary: destroy the stock, or sell devices whose genuineness nobody can verify. It chose destruction, plus a new key for all future devices. It is also why owners need to think in terms of delivery dates rather than firmware versions. There is no update that moves an old-key device onto the new key. The question is never “did you update?” — it is “when did your device arrive, and which key does it carry?”

Can I use the device I already own?

Keystone’s guidance splits on one date: October 20, 2026, the day the unauthorized access was found and blocked.

• Delivered before October 20: A device that passes the authenticity check can be considered genuine and used normally, according to Keystone. The reasoning is that counterfeits built with the stolen key could only plausibly enter circulation after the key was taken.
• Received after October 20 with the old key: Do not use the device until Keystone support confirms it is genuine. Keystone’s own words are blunt: “Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit.” Owners in this group should contact Keystone support and follow the instructions on its device verification page.
• Waiting on an order from Keystone’s website: Shipping is paused until devices with the new key are ready. As of October 27, the store listed the Keystone 3 Pro as a preorder expected to ship within 4 to 6 weeks.
• Already holding crypto with a Keystone: Owners do not need to move their crypto just because of the incident, Keystone says. The exception is the received-after-October-20 old-key group above, which should still get confirmation before using the device.
• Bought through Amazon or a reseller: The same guidance applies, because it is based on when a device arrived, not where it was bought. Keystone sells through Amazon official stores and authorized resellers.

That last point is where the guidance gets thin, and owners should know it. Keystone has not said whether devices with the old key are still on sale through Amazon or resellers, nor how an owner tells which key a device carries, nor what owners who have already sent crypto to a post-October-20 old-key device should do. Its verification page showed no such instructions as of October 27. If you are in the received-after-October-20 group, the honest position is: wait for Keystone’s confirmation, and do not treat a passing check as proof.

What customer data was exposed — and what was kept too long?

The incident affected 25,964 buyer records from purchases on Keystone’s website between 2024 and 2026. The records hold names, contact details, shipping addresses, and order details. Keystone’s online store runs on Shopify, which stored and managed the records. Payment card and bank details and government ID numbers were not involved, Keystone says, and purchase records from Amazon and other sales channels were not affected.

Keystone has also included 12,873 unpaid checkout records in its response as a precaution. These hold names, contact details, and shipping information from purchases that were never completed — people who started a checkout and never paid are in the exposure set too.

Then there is the part Keystone owned outright. The company had promised to delete shipping information 180 days after each order. An automated tool it built to erase records in bulk did not work reliably: some deletions failed, and Keystone did not catch the failures in time. Some of the affected data should already have been deleted. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.

The fix is a shorter retention window: Keystone is cutting customer data retention from 180 days to 90 days, effective immediately, has asked Shopify to delete buyers’ personal data older than 90 days, and expects that to be done by November 3. As of October 27, its privacy policy still listed 180 days — a small detail worth checking at publish time, because it is the kind of promise that either gets updated or quietly stays wrong. Keystone is emailing affected customers and plans a page where people can check whether their information was affected.

Why this breach is part of a pattern, not an outlier

Keystone’s update came a day after hardware wallet maker Foundation disclosed a separate breach in which attackers sent phishing emails that appeared to come from its official domains. Foundation said it had identified more than 23,000 phishing email attempts, found no evidence that Passport devices or private keys were compromised, and also found older database copies that its 60-day deletion process had missed — records containing about 5,600 mailing addresses and 5,200 phone numbers.

Two makers, two breaches, the same two failures: customer databases that were supposed to be pruned but were not, and attackers going after the trust layer around the device rather than the device’s cryptography. CoinDesk’s coverage adds the wider context from this year: at Ledger, criminals fitted devices sold through resellers in Southeast Asia with hidden components capturing recovery phrases during setup, and a flaw in Coldcard’s seed-generation software let attackers reconstruct private keys and drain wallets remotely.

The pattern is the lesson. Hardware wallets are still the safest way for most people to hold crypto, because the keys stay offline. But the ecosystem around them — the website, the store, the verification check, the reseller shelf, the email inbox — is where attackers now work. A device can be cryptographically sound and still be the wrong device to trust, if the check that vouches for it has been compromised or the seller was not who they claimed to be.

The scam wave to expect next

Keystone’s own warning is the most actionable sentence in its disclosure: treat any call, text, email, or letter offering a refund, a replacement device, a recall, wallet verification, or help moving crypto as a scam. Keystone will not ask anyone to return a device. Never enter a recovery phrase into a device you did not order, and type keyst.one into your browser instead of following links.

That warning is not boilerplate. The exposed data — names, shipping addresses, order details — is exactly what a scammer needs to make a message feel personal: “we are replacing your Keystone 3 Pro, shipped to your address, because of the October breach.” Affected customers should expect phishing that references their real order, and should treat any unsolicited contact about this breach as hostile until proven otherwise through Keystone’s own site, typed in by hand.

What is still unknown

Three questions remain open, and each one decides something for a real owner. First, are counterfeit devices already in circulation, or is the destruction purely preventive? Keystone has reported none, but it has not said how it would detect them. Second, is old-key stock still for sale anywhere — Amazon, resellers, third-party storefronts — and if so, when does it get pulled? Third, what should an owner who already funded a post-October-20 old-key device do: leave the funds, move them, and to what device? Keystone has not answered that one, and it is the question most likely to be asked by the people most at risk.

One distributor has already moved on its own: BitcoinVN Shop suspended Keystone sales on October 27, 2026, and cancelled or put pending orders on hold until further notice. That answers the reseller question for one shop, not for Amazon or other resellers — the wider stock question is still open.

This draft will need a freshness check at publish time for a Keystone update on any of those three points, for the promised affected-customer check page going live, and for the privacy policy moving from 180 days to 90 days.

Related reading

• University of Copenhagen Breach: 525,000 People, and the Test System That Held Their Data — another breach where a test environment held real people’s real data, and the same retention question.
• Crypto Hacks Are Surging but Stealing Less — Here’s Why — the wider crypto-theft wave this breach sits inside, and why smaller hauls are the new pattern.
• Aokigahara Malware Targets ChatGPT, Claude and Cursor Credentials — stolen credentials as the entry point, and the revoke-and-rotate response.

Sources

• CoinDesk, “Crypto wallet maker Keystone is destroying nearly 19,000 devices after a major security breach,” October 27, 2026: https://www.coindesk.com/business/2026/10/27/crypto-wallet-maker-keystone-to-destroy-almost-19-000-devices-after-security-breach
• The Hacker News, “Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key,” October 27, 2026: http://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html
• BitcoinVN Shop, “Keystone security incident and guidance for BitcoinVN Shop customers,” October 27, 2026: https://bitcoinvn.io/shop/keystone-security-incident/

Last verified: October 28, 2026.