Keystone's Oct 26 statement expands its Oct 24 disclosure. The attacker who got into its website on Oct 20 exploited a vulnerability in a third-party data monitoring tool on the site to escalate privileges (the tool isn't named).

• Device authentication key stolen. The attacker obtained the WebAuth key used by keyst.one/authentication to check whether a device is genuine. It is written in at manufacture and can't be changed. It plays no part in seed generation, key derivation or signing, but it would let someone build counterfeit wallets that pass Keystone's authenticity check. Keystone has switched production to a new key, will destroy the 18,835 devices in inventory that carry the old one, and has paused shipping of website orders (sales move to preorder).
• Customer data: 25,964 Shopify buyer records from 2024 to 2026 with names, contact details, shipping addresses and orders, plus 12,873 abandoned-checkout records. Keystone admits its 180-day deletion tool silently failed, so data was kept longer than promised. It is cutting retention to 90 days. Recovery phrases, private keys, payment data and ID numbers weren't involved.

If you own one: a device delivered before Oct 20 that passes authentication is fine. If you received an old-key device after Oct 20, contact Keystone support for extra verification before use, even if it passes. Keystone won't ask for returns, so treat any "recall", "asset migration" or "wallet verification" contact as a scam. Expect targeted phishing at the leaked shipping addresses.