Hardware wallet maker Keystone said in an Oct. 26 post on X that it will destroy 18,835 devices sitting in inventory after the intruder behind its website breach also obtained the WebAuth key used in the company’s device-authenticity checks. Keystone also said it is freezing shipments for website orders that have not yet been sent.
The company said the risk comes from the way the key is used. Keystone burns the key into devices during manufacturing, and it cannot later be erased or rewritten. If someone holds a copy of that key, they could produce counterfeit devices that Keystone’s own verification page would authenticate as genuine. The company said that scenario could lead to stolen funds.
Keystone said it is switching factory production to a fresh key. Until devices built with the new key are ready, new units will be sold only as preorders.
The company added that the key has no role in generating recovery phrases, deriving private keys, or signing transactions.
Which devices Keystone says can be trusted
According to Keystone, devices delivered before Oct. 20 — the day its monitoring systems flagged unusual access to the website — can be trusted if they pass authentication.
For devices received after that date that still carry the old key, Keystone said, 「we cannot completely rule out the possibility that it is counterfeit, even when the check passes.」 The company asked those owners to contact support before using the device.
Keystone also said it will not ask anyone to send a device back, and that any recall request of that kind is a scam.
Scope of the customer data exposure
The statement also added figures to the customer-data exposure that Keystone first disclosed on Oct. 24. The company said the intrusion touched 51,083 buyer records from its Shopify store.
Of those, personal details tied to 25,119 records had already been erased. Another 25,964 records from 2024 to 2026 still contained names, contact details, shipping addresses, and order information.
Keystone said a further 12,873 checkout records for purchases that were never paid also held names, contact details, and shipping details, though it added that some of those details may not have been complete or accurate.
The company said it asked Shopify on Oct. 24 to erase personal data in checkout records kept for more than 30 days.
Deletion failures and revised retention period
Keystone said its policy had called for buyer records to be erased after 180 days. But a bulk-erasure tool the company built did not operate reliably, and failed deletion jobs were not caught in time. As a result, some personal data remained on file past the deadline.
In its statement, the company said, 「We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.」
Keystone said the overdue-data deletion requests should be completed on Nov. 3 after a 10-day waiting period. The statement also said those requests cover data beyond a 90-day retention period, which is the shorter limit Keystone said it is now adopting in place of 180 days.
Cause of the breach and data not involved
Keystone said it traced the intrusion to a flaw in a third-party data monitoring tool on its website, though it did not name the tool.
The company said recovery phrases, private keys, bank payment details, and government ID numbers were not involved.
Keystone also said it has filed reports in the EU, the UK, and other jurisdictions.