Hardware wallet maker Keystone is scrapping 18,835 unsold devices after an attacker who broke into its website on October 20 also took the factory key used to check whether a wallet is genuine. An October 26 X post widened an incident first disclosed on October 24 as a customer-data leak. Burned into devices during production, the key cannot be erased or rewritten, so a copy in attacker hands could let fake wallets pass Keystone's own authenticity check. Unshipped website orders are halted, factory production has switched to a fresh key, and website sales move to preorders until new-key devices are ready.
The destruction is the blunt part. Underneath it sits the data failure buyers should read twice.
Keystone's Shopify store generated 51,083 buyer records: 25,119 deleted under the 180-day retention policy, 25,964 records dated 2024-2026 still listing buyer names, contact and shipping details, and order data. Checkout files for 12,873 unpaid orders may also have been touched. On October 24 Keystone asked Shopify to delete checkout personal data kept over 30 days; overdue-data requests should complete on November 3, per Unchained. Retention is now 90 days, down from 180. Keystone blamed a bulk-erasure tool that did not run reliably, with failed jobs going unnoticed, and admitted missing its own erasure deadline.
No bank payment data or government ID numbers were touched. Wallet credentials, private keys and recovery phrases were likewise untouched, all three outlets agree. Generating recovery phrases, deriving keys and signing transactions do not use the stolen key. Pre-October 20 deliveries can still be used when authentication passes. Post-October 20 old-key units sit in a different bucket: Keystone said it cannot rule out a fake even if authentication succeeds, and asked those owners to contact support before use. Keystone will not request any device return, warned that "recall" requests are scams, and said users need not move funds because of the breach alone.
| Breach measure | Count | Note |
|---|---|---|
| Buyer records generated | 51,083 | Shopify store total |
| Deleted under 180-day policy | 25,119 | 49.2% of buyer records |
| Still on file and exposed | 25,964 | 50.8%, 2024 to 2026 |
| Unpaid checkout records possibly affected | 12,873 | Purchases never completed |
| Unsold wallets to destroy | 18,835 | All carry the old key |
Why it matters
An authenticity check is the trust anchor for a self-custody purchase. A stolen factory key breaks that check at the source: a fake unit could present as genuine on the page meant to catch fakes. Leaked shipping addresses compound the problem, telling an attacker where a self-custody user lives. That combination is why this incident travels further than a routine website leak. CoinDesk and CoinTelegraph place Keystone in a 2026 run of hardware-wallet incidents spanning Ledger reseller implants, a Coldcard seed bug and Foundation phishing attempts. MarketRadar's October 27 snapshot put bitcoin at $79,810, down 0.57%, and ether at $2,312, down 0.68%, as traders watched the Federal Reserve's October 27-28 meeting. Keystone's news did not set those prices, but custody hardware is under scrutiny on the same day, after bitcoin held near $80,000 into the Fed decision week and Kraken opened bitcoin and ether options to eligible European clients.
What to watch
- Whether new-key devices ship on schedule, and whether counterfeit units surface for sale before resellers flag them.
- Whether overdue-data erasure requests complete on November 3 as Unchained reported.
- What follows from Keystone's EU and UK filings, plus reports elsewhere.
- Whether the Ledger reseller sweep and Foundation phishing follow-through produce further disclosures.
Key points
- Keystone is scrapping 18,835 unsold wallets carrying a stolen WebAuth key that cannot be erased or rewritten.
- The October 20 intrusion, via a third-party monitoring tool flaw, exposed buyer records numbering 25,964, dated 2024 to 2026.
- Unpaid-order checkout files numbering 12,873 may also have been touched.
- Wallet credentials, private keys, recovery phrases, bank payment data and government ID numbers were untouched.
- Devices delivered before October 20 remain safe if they pass authentication; post-October 20 old-key units need a support check first.
MarketRadar take
Destroying a known-bad batch removes one risk, but it does not retroactively repair trust for post-October 20 old-key units already delivered. Owners in that group should use the support channel Keystone named, not any message demanding a return or a fund move. Across 2026, the pattern runs through third-party tools, resellers, shipping partners and data handling, rather than one wallet model alone. That is the thread to follow into the next disclosure.
