Your Keystone hardware wallet might not be the genuine article, because an attacker who breached the company's website walked away with the cryptographic key that proves a device is authentic, and anyone holding that key can build counterfeit devices that pass the official online check.
Keystone disclosed the breach in a statement on October 26, noting that the incident did not involve owners' recovery phrases or wallet private keys. The attacker gained access on October 20, and the company has since blocked the intrusion and fixed the vulnerability.
How the Attack Happened
The attacker exploited a vulnerability in a third-party data monitoring tool used by Keystone's website to escalate privileges, according to the company. That escalation let the attacker obtain both customer data and the firmware key. Keystone has not said where the key was stored or when the attacker first gained access.
Why the Verification Key Matters
Keystone owners verify their devices by scanning a QR code on the company's verification page, then entering the code the device displays. In Keystone's open-source firmware, the QR code carries that code in encrypted form, and the device decrypts it using its stored key. A correct code proves the device holds the key.
The key is used only for this check. It plays no part in creating recovery phrases, deriving private keys, or signing transactions. But anyone with a copy of the key can produce the right codes, which means a counterfeit device carrying it would pass authentication.
Keystone will destroy 18,835 unsold devices that carry the compromised key, and all new devices will get a new one.
The Write-Once Problem
The key is written into each device during manufacturing and cannot be erased or rewritten. The firmware stores it in write-once memory and refuses to accept a second key. That means devices already made cannot be switched to the new key. They are permanently tied to the compromised version.
What Owners Need to Do
Keystone's guidance depends entirely on when your device arrived.
|
Device Status |
What to Do |
|
Delivered before October 20 |
If it passes the verification check, it is genuine and can be used normally. |
|
Received after October 20 with the old key |
Do not use the device until Keystone support ([email protected]) confirms it is genuine. Keystone says it cannot completely rule out that such a device is counterfeit. |
|
Waiting on an order from Keystone's website |
Shipping is paused until devices with the new key are ready. The store listed the Keystone 3 Pro as a pre-order with a 4 to 6 week wait as of October 27. |
|
Bought through Amazon or a reseller |
The same guidance applies, because it is based on delivery date, not purchase location. |
|
Already holding crypto with a Keystone |
You do not need to move your crypto just because of the incident, but follow the steps above if your device arrived after October 20. |
As of October 27, Keystone's device verification page showed no specific instructions for owners in the "received after October 20" category. The company has not said how to tell which key a device carries, or what owners who already sent crypto to such a device should do.
The Customer Data Exposure
Keystone first disclosed the breach on October 24, saying a third party had obtained customers' shipping information. The incident affected 25,964 buyer records from purchases on Keystone's website between 2024 and 2026.
The records hold names, contact details, shipping addresses, and order details. Keystone's online store runs on Shopify, which stored and managed the records. Payment card and bank details and government ID numbers were not involved. Purchase records from Amazon and other sales channels were not affected.
Keystone also included 12,873 unpaid checkout records in its response as a precaution. These hold names, contact details, and shipping information from purchases that were never completed.
The Failed Deletion Promise
Some of the affected data should already have been deleted. Keystone had promised to delete shipping information 180 days after each order. An automated tool Keystone built to erase records in bulk did not work reliably. Some deletions failed, and Keystone did not catch the failures in time.
Keystone is shortening the retention period from 180 days to 90 days, effective immediately. It has asked Shopify to delete buyers' personal data older than 90 days and expects that to be done on November 3. As of October 27, its privacy policy still listed 180 days.
Scam Warnings
Keystone is emailing affected customers and plans a page where people can check whether their information was affected. The company warns that any call, text, email, or letter offering a refund, a replacement device, a recall, wallet verification, or help moving crypto should be treated as a scam.
Keystone will not ask anyone to return a device. Never enter a recovery phrase into a device you did not order, and type keyst.one into your browser instead of following links.
FAQ
What did the attacker actually steal from Keystone?
The attacker obtained the firmware key used to verify that a Keystone device is genuine, along with customer records including names, contact details, shipping addresses, and order details.
Does this mean my crypto is at risk?
No. Keystone says the incident did not involve recovery phrases or wallet private keys. The compromised key is used only for the device verification check.
How do I know if my Keystone device is genuine?
If your device arrived before October 20 and passes the verification check on Keystone's website, it is genuine. If it arrived after October 20, contact Keystone support at [email protected] before using it.
Can Keystone just push a new key to existing devices?
No. The key is written into write-once memory during manufacturing. The firmware refuses to accept a second key, so existing devices cannot be switched to the new one.
Why did Keystone still have my data after 180 days?
Keystone promised to delete shipping information 180 days after each order, but its automated bulk-deletion tool did not work reliably. Some deletions failed, and the company did not catch the failures in time. It is now shortening the retention period to 90 days.
