Hardware wallet manufacturer Keystone has expanded its disclosure of a website security breach first detected earlier this month, revealing that attackers obtained not only certain customer records but also a specialized authentication key used to confirm that its physical devices are genuine.
The company detected unusual access to its official website on October 20, 2026.
Security monitoring triggered an immediate response that same day: sensitive website functions were disabled, unauthorized access points were blocked, the underlying vulnerability was patched, and a forensic investigation began alongside further protective measures.
Investigators determined that the intruder leveraged a flaw in a third-party data monitoring tool employed on the site, using it to elevate privileges.
This access allowed the extraction of limited customer information along with the WebAuth key that powers authenticity checks on Keystone’s device verification page.
That key is embedded in hardware units at the factory stage and cannot later be erased or overwritten.
Its sole purpose is confirming legitimacy during the WebAuth verification process; it plays no role in generating recovery phrases, deriving private keys, or signing transactions.
Because the key underpins trust in the company’s authenticity mechanism, its exposure creates a pathway for counterfeit devices to satisfy official checks.
Such fakes could potentially be distributed or shipped to buyers who might then treat them as legitimate products, raising the possibility of subsequent asset loss.
Keystone has stressed that the incident did not compromise recovery phrases, wallet private keys, other credentials, bank or payment details, or government identification numbers.
Users are therefore not required to move funds solely on account of this event, though they should remain alert to unsolicited contacts offering “migration,” “verification,” or “investigation” assistance.
On the data side, the breach touched records tied to purchases through the Shopify-powered store on Keystone’s official site.
Of 51,083 buyer records generated there, personal details associated with 25,119 had already been permanently removed in line with retention rules, leaving only anonymized order information.
The remaining 25,964 records still held names, contact details, shipping addresses, and order information spanning 2024 to 2026.
Amazon and other sales channels were unaffected.
The company also identified 12,873 incomplete checkout records containing names, contacts, and shipping data; these were included in response measures as a precaution.
Keystone acknowledged that an automated bulk-erasure tool it developed to supplement Shopify’s manual process had failed intermittently, allowing some personal data to remain past the intended 180-day window—an operational shortcoming it accepted responsibility for addressing.
Erasure requests for overdue data were submitted to Shopify on October 24, with completion expected around November 3 after a required waiting period.
Retention will now be shortened to 90 days, and additional safeguards are being implemented.
To contain the authentication-key risk, Keystone has halted use of the old key in production effective immediately.
All newly manufactured devices will incorporate a fresh authentication key.
The 18,835 units already in inventory that carry the compromised key will be destroyed and will neither be sold nor shipped.
Unshipped orders placed through the official website have had delivery suspended, with sales shifted to a preorder model until the new-key production run is ready; shipping is anticipated to resume within four to six weeks.
Guidance for device owners hinges on the October 20 discovery date.
Units manufactured and delivered before that date retain trustworthy authentication; if a check passes, the device may be treated as genuine and used normally.
For devices received after October 20 that still use the old key, even a successful authentication check does not fully eliminate the chance of a counterfeit.
Owners are directed to follow instructions on the authentication page and contact official support for further verification before use.
The company will not request that any devices be returned; communications claiming a “recall” and asking for shipment of hardware should be treated as fraudulent.
Keystone has notified affected individuals by email, is preparing lookup tools so users can check whether their information was involved and later confirm erasure, and has already filed required reports with authorities in jurisdictions including the EU and UK.
It continues to strengthen access controls, key management, and overall data practices while publishing updates through official channels. The firm has apologized for the concern, inconvenience, and erosion of trust caused by the incident and pledged ongoing support for verification and remediation efforts.
