Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
Keystone is destroying 18,835 hardware wallets after hackers stole the device verification key from its website, enabling the creation of counterfeit devices that could trick users into losing cryptocurrency.
Keystone, a manufacturer of cryptocurrency hardware wallets, has announced it will destroy 18,835 unsold devices after a breach of its website resulted in the theft of a critical device verification key. The compromised key allows attackers to create counterfeit hardware wallets that can pass Keystone's online authenticity checks, posing a significant risk to users who might unknowingly trust a fraudulent device and subsequently lose their digital assets.
The incident came to light on October 20 when Keystone detected unauthorized access to its website. The attacker exploited a vulnerability in a third-party data monitoring tool, which enabled privilege escalation and granted access to both customer data and the crucial verification key. While the company has since blocked the attacker's access and patched the vulnerability, the implications for existing and newly shipped devices are substantial.
The device verification process involves users scanning a QR code from their Keystone device onto the company's verification page. The device then decrypts this code using its stored key. A successful decryption confirms the device's authenticity. However, with the verification key now in the hands of malicious actors, counterfeit devices equipped with this key could generate correct codes, thereby deceiving users into believing they possess a genuine product.
Keystone has stated that the stolen key is embedded in each device during manufacturing and cannot be altered or rewritten. This means that devices already produced cannot be updated to use a new, secure key. Consequently, the company has decided to destroy all 18,835 unsold units that were manufactured with the compromised key. New devices will be issued with a fresh, secure key.
Customers who received a device after October 20 and whose device passes the authenticity check are advised by Keystone not to use it until support confirms its genuineness. Devices delivered before October 20 that pass the check are considered safe. Shipping of new orders has been paused until devices with the new key are ready, with current pre-orders for the Keystone 3 Pro expected to ship within four to six weeks.
In addition to the hardware wallet verification key, the breach also exposed customer data from 25,964 purchase records on Keystone's website between 2024 and 2026. This data includes names, contact details, shipping addresses, and order information. The company is also including 12,873 unpaid checkout records as a precaution. Keystone has acknowledged that an automated tool designed to delete customer data after 180 days was not functioning reliably, leading to some older records being retained longer than policy dictated. As a corrective measure, Keystone is reducing its data retention period to 90 days and has requested Shopify, its e-commerce platform, to delete older data.
Keystone is actively contacting affected customers via email and plans to launch a dedicated webpage for individuals to check if their information was compromised. The company has also issued a stern warning against potential scams, urging users to treat any unsolicited offers for refunds, replacements, or assistance with moving crypto as fraudulent. Users are advised to navigate directly to keyst.one and avoid clicking on suspicious links or entering recovery phrases into unfamiliar devices.
This incident highlights the critical importance of securing not only customer data but also the integrity of hardware authentication mechanisms. The theft of the device verification key, even without direct access to private keys or recovery phrases, creates a sophisticated attack vector that could lead to widespread user distrust and financial loss in the cryptocurrency ecosystem.