Key Points
- A website breach at Keystone resulted in the theft of an authentication key that verifies hardware wallet legitimacy.
- Fraudsters could potentially manufacture counterfeit wallets that would pass the company’s verification systems using the stolen key.
- Nearly 19,000 devices containing the compromised authentication key will be scrapped, with all shipments temporarily halted.
- Customer information from up to 25,964 purchase records spanning 2024 to 2026 may have been compromised due to a malfunctioning data deletion system.
- Products shipped prior to October 20 remain secure, though the company cannot verify the safety of units delivered afterward.
Cryptocurrency hardware wallet manufacturer Keystone disclosed that cybercriminals who infiltrated its website last week obtained sensitive authentication credentials used to confirm device authenticity. The company initially characterized the security incident as a customer information leak.
According to a Monday announcement, Keystone warned that the compromised authentication key enables malicious actors to manufacture fraudulent wallets capable of passing official verification protocols.
“These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” Keystone said.
Breach Method Revealed
The company explained that the perpetrator exploited a vulnerability within a third-party monitoring application integrated into its website to escalate access permissions.
“This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices,” the company said.
In response, Keystone announced plans to dispose of 18,835 units in current inventory that were manufactured with the compromised authentication key. All deliveries of affected device models have been suspended indefinitely.
Distribution will resume only after the company transitions to manufacturing units with an updated authentication system.
Scope of Data Compromise
The hardware wallet provider reported that its Shopify-based storefront had generated 51,083 buyer records total. Under the company’s 180-day information retention protocol, 25,119 of these records had supposedly been purged.
The outstanding 25,964 records, covering transactions from 2024 through 2026, are believed to have been accessed by the attacker. Keystone acknowledged these historical records persisted because its automated purging mechanism malfunctioned.
“The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period,” Keystone said.
Additionally, the intruder may have obtained access to 12,873 abandoned checkout records stored by Shopify. These entries originate from incomplete transactions.
Keystone confirmed it has requested Shopify permanently remove personally identifiable information from checkout records maintained longer than 30 days.
This security incident represents another in a series of attacks targeting hardware wallet manufacturers throughout the current year. Earlier this month, Ledger instructed distributors across Southeast Asia and Hong Kong to cease product sales. The directive came after discoveries that devices distributed in those regions contained unauthorized hardware modifications designed to intercept recovery phrases.
In late July, Coldcard manufacturer Coinkite issued an urgent alert to users following the exploitation of a software defect. The vulnerability caused affected devices to generate wallet seeds with insufficient entropy, ultimately resulting in cryptocurrency thefts totaling millions of dollars.
In August, Trezor announced a security breach affecting its logistics partner. The incident’s scope expanded to encompass more than 80,000 users by September.
SafePal identified an order-tracking vulnerability in August that resulted in exposure of information belonging to nearly 40,000 customers. BitBox became the target of a September phishing operation linked to a compromised third-party email service provider.
The current Keystone situation bears resemblance to a June 2020 Ledger data breach. That incident exposed more than 1 million email addresses alongside customer names, telephone numbers and residential addresses, subsequently fueling persistent phishing campaigns for years.
Keystone emphasized that hardware wallets manufactured and distributed before the October 20 security incident should be regarded as secure. Authentication verification for these units remains reliable.
Nevertheless, the company stated it cannot provide assurances regarding devices delivered following that date. Affected purchasers have been advised to reach out to the company’s support team for additional verification assistance.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
