In brief – Keystone will destroy 18,835 unsold hardware wallets and has suspended shipping after an attacker obtained the permanent factory key used to verify its devices are genuine. – The breach, detected October 20, also affected 25,964 buyer records from Keystone’s Shopify…
ore, covering 2024 to 2026 and including names, contact details and shipping addresses. – Keystone says recovery phrases and private keys were not involved, and that devices delivered before October 20 are unaffected. Keystone, a maker of Bitcoin hardware wallets that keep the secret codes controlling your crypto offline, said Monday it will destroy 18,835 unsold devices after attackers obtained the key that proves its hardware is genuine
The company has also suspended shipping of all unshipped orders from its website. For buyers, the risk is a counterfeit wallet that looks brand new and passes Keystone’s own verification check, because the attacker obtained the key that the check relies on. A criminal could then sell such a device to someone who loads real savings onto it. “If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks,” Keystone said in its statement. “These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.” Keystone calls it a WebAuth key, a secret code written into each device at the factory so a page on the company’s website can confirm the hardware is real.
It cannot be erased or rewritten, and the 18,835 units in inventory that carry it are being destroyed rather than sold. Keystone first said Saturday that a third party had obtained customer shipping information. Monday’s statement added the stolen key and a count of 25,964 affected buyer records, but it does not say who is responsible or when the attacker first got in.