Hardware wallet manufacturer Keystone has disclosed a major security incident involving compromised customer information and a stolen device authentication key. The breach has prompted the company to suspend shipments, announce the destruction of 18,835 hardware wallets, and introduce stricter data protection measures.
In its official security update published on October 26, 2026, Keystone outlined the extent of the incident, the risks for customers, and the steps being taken to prevent similar breaches in the future.
Security Breach Exposes Customer Data and Authentication Key
Keystone detected unauthorized access to its official website on October 20, 2026. According to the company, attackers exploited a vulnerability in a third-party data monitoring tool, allowing them to escalate their access privileges and obtain customer information alongside a key used to verify the authenticity of Keystone hardware wallets.
The compromised authentication key presents a particular security concern because it could potentially allow counterfeit devices to pass Keystone's official authenticity checks.
Keystone emphasized that the stolen authentication key is separate from the cryptographic mechanisms responsible for generating recovery phrases, managing private keys, and signing transactions. According to the company, customers' recovery phrases, private keys, and wallet credentials were not compromised.
Nearly 39,000 Customer Records Potentially Affected
The investigation identified 25,964 customer purchase records from 2024 to 2026 containing personal information, including names, contact details, shipping addresses, and order information.
An additional 12,873 incomplete checkout records stored through Shopify were also included in the scope of the incident. These records may contain personal details entered by customers who did not complete their purchases.
Together, the two categories represent 38,837 potentially affected records, although this does not necessarily correspond to the same number of individual customers.
Keystone also acknowledged that certain customer information had been retained longer than its previously established 180-day retention period. The company attributed this failure to an automated data deletion tool that did not consistently execute scheduled erasure requests.
Customer Data Retention Reduced to 90 Days
In response to the breach and the shortcomings identified in its data management practices, Keystone announced an immediate reduction in its customer personal information retention period from 180 days to 90 days.
The company has initiated additional deletion requests to remove records that should no longer be stored. It also intends to strengthen the monitoring of data erasure processes to ensure that customer information is reliably deleted according to its retention policies.
Furthermore, Keystone will individually notify affected customers by email and provide dedicated customer support.
Two additional transparency measures are planned: a data breach lookup page that will allow users to check whether their personal information was affected, and a separate status lookup page where customers will eventually be able to verify whether their data has been erased.
Keystone to Destroy 18,835 Hardware Wallets
One of the most significant consequences of the incident is Keystone's decision to destroy 18,835 hardware wallets currently held in inventory.
These devices contain the previous authentication key, which can no longer be considered secure following its exposure.
Since the authentication key is embedded during manufacturing and cannot simply be replaced on existing devices, Keystone has decided to eliminate the affected inventory rather than risk distributing hardware wallets using the compromised authentication mechanism.
The company has also suspended shipments of outstanding orders until production of new devices incorporating an updated authentication key is completed.
What Existing Keystone Wallet Owners Should Know
Keystone has provided guidance to help customers assess whether their devices may be affected.
According to the manufacturer, devices delivered before October 20, 2026, that successfully pass the authenticity verification process can continue to be used normally.
However, customers who received devices using the previous authentication key after October 20 are advised to contact Keystone's official customer support before using them. Because the key has been compromised, a successful authenticity check alone may no longer be sufficient to establish that such a device is genuine.
Keystone has also warned users to remain vigilant against phishing attempts, fraudulent device recalls, and messages requesting cryptocurrency transfers.
The company stated that customers do not need to transfer their digital assets solely because of the security incident, and that it will not request the return of existing devices as part of a recall.
Security Audits and Regulatory Reporting Underway
Beyond the immediate containment measures, Keystone has committed to conducting a comprehensive security audit and reviewing the effectiveness of the implemented vulnerability fixes.
The company intends to strengthen its data access controls, authentication procedures, and key management practices to reduce the likelihood of future incidents.
Keystone also confirmed that it will fulfill applicable reporting obligations to regulators and law enforcement agencies. Reports have already been submitted in the European Union, the United Kingdom, and other relevant jurisdictions.
The Importance of Security Beyond Hardware Wallets
The Keystone incident highlights an important aspect of cryptocurrency self-custody: security extends beyond the hardware wallet itself.
While hardware wallets are designed to keep private keys isolated from internet-connected environments, the surrounding infrastructure—including e-commerce platforms, customer databases, supply chains, and authentication systems—can introduce additional security risks.
The compromise of Keystone's device authentication key demonstrates how weaknesses outside a wallet's core cryptographic architecture can undermine users' ability to verify the authenticity of their devices.
For hardware wallet manufacturers, the incident underscores the importance of robust key management, reliable data deletion procedures, and transparent incident response processes.
As Keystone works to replace its affected inventory and strengthen its security infrastructure, restoring customer confidence will depend on the successful implementation and independent verification of these measures.
