Keystone said it will destroy 18,835 unsold hardware wallets and suspend shipments after a website breach exposed customer data and an authentication key that could let counterfeit devices pass the company’s authenticity checks.
In a post on X on Monday, the hardware wallet maker said an attacker gained access to its website on Oct. 20 through a flaw in a third-party data monitoring tool. The breach exposed 25,964 buyer records from 2024 through 2026, including names, contact details, shipping addresses and order information. Another 12,873 unpaid checkout records may also have been affected.
Exposed key could make fake wallets appear genuine
Keystone said the stolen key is embedded into devices during production and cannot be changed later. Because that key is used to pass online authenticity checks, counterfeit wallets could appear legitimate, creating a risk to user funds. The company said that is why it will destroy 18,835 unsold units.
The firm added that the incident did not expose recovery phrases, private keys or wallet credentials.
Some customer records were kept beyond the stated retention period
Keystone also said some customer records should have been deleted under its 180-day retention policy, but an automated deletion tool failed and the company did not detect the issue.
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.
Latest incident adds to a run of hardware wallet attacks
The breach comes after several attacks on hardware wallet users this year. At Ledger, criminals modified devices sold through resellers in Southeast Asia by adding hidden components designed to capture recovery phrases during setup. In Coldcard’s case, a flaw in seed-generation software allowed attackers to reconstruct private keys and drain wallets remotely.
Keystone’s update came one day after hardware wallet maker Foundation disclosed a separate breach in which attackers sent phishing emails that appeared to come from the company’s official domains.
Foundation also found older database copies missed by deletion process
Foundation said it had identified more than 23,000 phishing email attempts and found no evidence that Passport devices or private keys were compromised.
The company also said older database copies had been missed by its 60-day data deletion process. In a later update, Foundation said attackers could access records containing about 5,600 mailing addresses and 5,200 phone numbers, though it could not confirm how many were actually accessed.
Guidance for users and next steps
Keystone said devices delivered before Oct. 20 remain safe to use if they pass authentication. Customers who received devices using the old key after that date should seek additional checks before using them.
The company said users do not need to move funds because of the breach alone. It also warned customers to ignore fake recall notices or asset migration messages.
As part of its response, Keystone said it will replace the authentication key in new devices, shift website sales to a preorder model and reduce customer data retention from 180 days to 90 days.