Keystone, a major hardware wallet manufacturer, says the attacker who compromised its website last week didn’t stop at leaking customer data. The breach also involved theft of an authentication key used to verify the authenticity of Keystone devices—raising the risk that counterfeit wallets could be made to pass the company’s checks.

In a statement shared Monday on X, Keystone warned that the stolen key could enable adversaries to produce cloned hardware wallets that appear legitimate to buyers. The company also outlined steps it is taking to contain the threat, including destroying tens of thousands of units in inventory that rely on the compromised key.

Key takeaways

Keystone says the same website breach included theft of a device authentication key, not just customer data exposure.
The company plans to destroy 18,835 hardware wallet units in inventory that contain the compromised key and has halted shipments using it.
Keystone reports 51,083 buyer records were generated by its Shopify store, with 25,119 deleted under its retention policy and 25,964 potentially retained due to a bulk-erasure tool failure.
Keystone says devices delivered before the Oct. 20 incident should remain trustworthy, but it cannot guarantee authenticity for devices delivered after that date.
The incident underscores a broader pattern of hardware wallet supply-chain and third-party attack attempts across the industry in 2024.

What Keystone says was stolen—and why it matters

Keystone’s update reframes the breach from a conventional data incident into a broader security concern tied directly to wallet integrity. The company said the attacker was able to obtain “a key used to verify the authenticity of our devices,” according to its Monday statement.

That key, Keystone explained, could allow an adversary to create counterfeit wallets that successfully complete the authenticity checks. If those cloned devices reached customers and users treated them as genuine, attackers could potentially facilitate asset theft—an outcome that would be far more damaging than phishing or marketing-targeting risks typically associated with customer database leaks.

Keystone did not claim that the attacker has already produced counterfeits, but the possibility itself changes how affected users and resellers should view device provenance, especially around the time window when the compromised key may have been embedded into production and inventory.

Inventory destruction and a cutoff date for device trust

Keystone said the attacker exploited a vulnerability in a third-party monitoring tool used for its website, enabling privilege escalation. As part of the remediation, the company stated it will destroy 18,835 devices in its inventory that contain the compromised authentication key.

In addition to destroying affected stock, Keystone suspended production shipments of any devices using the compromised key. Shipments are expected to resume only after the company begins manufacturing units with a new authentication key.

Keystone also drew a distinction between devices by delivery timing. It said devices manufactured and delivered before the Oct. 20 incident should be considered safe and that their authenticity checks remain reliable. For devices delivered after Oct. 20, the company said it cannot guarantee authenticity and instructed potentially affected customers to contact support for additional verification.

The data breach scope: Shopify buyer records and retention failures

Alongside the authenticity-key issue, Keystone confirmed the size of its customer data exposure. The company said its Shopify store generated 51,083 buyer records.

Under a stated 180-day data retention policy, Keystone said 25,119 of those records had been deleted. However, 25,964 records dating from 2024 to 2026 may have been stolen by the attacker. Keystone attributed the remainder to a failure in an automated tool responsible for handling bulk erasure—Keystone said the tool did not operate reliably, some deletion tasks failed, and the company did not detect and correct those failures in time.

Keystone said the incident could have left some personal information stored beyond the permitted retention period, increasing the volume of data potentially reachable to the attacker.

The company also indicated the attacker may have accessed 12,873 customer checkout records retained by Shopify. Keystone described these as checkout records for purchases that were not completed. It said it contacted Shopify to request deletion of personal information in those checkout records retained for more than 30 days.

A wider hardware wallet security pattern

Keystone’s disclosure comes amid a string of incidents affecting hardware wallet manufacturers this year, particularly where third-party services and supply-chain elements are involved.

Earlier in 2024, Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales after reports of unauthorized device modifications capable of capturing recovery phrases, according to coverage from Cointelegraph. In late July, Cointelegraph also reported that Coinkite, the maker of the Coldcard hardware wallets, warned users after attackers reportedly exploited a bug that caused wallet seeds to be generated with less entropy than intended—leading to theft losses. The recurring theme is that vulnerabilities can extend beyond software updates into manufacturing, logistics, or infrastructure used by companies to operate their commerce and verification systems.

Other manufacturers have also reported data-related breaches involving shipping partners, order tracking tools, or compromised third-party services. Cointelegraph noted that Trezor disclosed a breach affecting its shipping partner earlier this year, with the number of affected users expanding over time. Cointelegraph also reported that SafePal disclosed an order-tracking vulnerability exposing customer information, while BitBox was targeted in a phishing campaign involving a compromised third-party email provider.

Taken together, these incidents highlight a risk environment in which hardware wallets—despite being designed for private-key protection—can still be exposed at the edges: customer databases, e-commerce backends, device authenticity mechanisms, and operational tooling.

What to watch next

Keystone has promised to move forward with a fresh authentication key and to route any authenticity checks for post–Oct. 20 deliveries through its support process. Users should stay alert for guidance on device verification, while industry participants watch whether the broader move toward new keys and tighter controls around third-party tooling becomes a standard response rather than a reactive scramble after each incident.