Keystone said a website breach disclosed last week was more serious than first reported, with the attacker stealing not only customer information but also a key used to verify whether its hardware wallets are genuine.
In a statement released Monday, the hardware wallet maker said the stolen authentication key could allow attackers to create counterfeit devices that still pass the company’s authenticity checks.
"These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft," Keystone said.
The disclosure adds to a growing list of security incidents involving hardware wallet manufacturers this year.
Earlier this month, Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales after reports that devices sold in those markets contained unauthorized implants capable of capturing recovery phrases.
In late July, Coinkite, the maker of Coldcard, warned users after attackers exploited a bug that caused devices to generate wallet seeds with less entropy than intended. The issue led to the theft of millions of dollars in crypto, according to the company.
Keystone to destroy 18,835 devices carrying the old key
In its latest update, Keystone said the attacker exploited a vulnerability in a third-party monitoring tool used on its website and then escalated privileges.
The company said this gave the attacker access to some customer information as well as a key used to verify the authenticity of Keystone devices.
Keystone said it plans to destroy 18,835 devices in inventory that contain the compromised key. It has also suspended production shipments of all devices that use that key.
The company said shipments will resume once it starts producing devices with a new authentication key.
Keystone added that devices manufactured and delivered before the Oct. 20 incident should still be considered safe, and their authenticity checks remain reliable.
At the same time, it said it could not guarantee the authenticity of devices delivered after that date and urged affected customers to contact its support team for additional verification.
Company says 25,964 buyer records were stolen
Keystone also disclosed the scale of the customer data breach. It said its Shopify store had generated 51,083 buyer records in total.
Of that number, 25,119 records had already been deleted under the company’s 180-day data retention policy.
The remaining 25,964 records, dating from 2024 to 2026, were stolen by the attacker. Keystone said those older entries had not been deleted because an automated tool used for bulk data erasure failed.
"The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period," the company said.
In addition, the attacker obtained another 12,873 customer checkout records retained by Shopify. Keystone said those records were tied to purchases that had not been completed.
The company added that it had contacted Shopify to request deletion of personal information in checkout records retained for more than 30 days.
Hardware wallet makers have faced repeated security incidents this year
The Keystone breach echoes Ledger’s June 2020 data leak, which exposed more than 1 million email addresses along with customer names, phone numbers and physical addresses. That leaked information fueled phishing attempts against affected users for years.
Other hardware wallet manufacturers have also reported incidents involving customer information and third-party services in 2026.
In August, Trezor disclosed a breach at its shipping partner that exposed customer information. By September, the number of affected users had risen to more than 80,000.
SafePal also reported an order-tracking vulnerability in August that exposed data belonging to nearly 40,000 customers. In September, BitBox was targeted in a phishing campaign involving a compromised third-party email provider.