---
title: Keystone says the website intruder also stole the key that proves its hardware wallets are genuine, so it will destroy 18,835 devices in stock; 25,964 buyer records exposed | ctxsec
url: https://ctxsec.com/items/keystone-webauth-device-key-stolen-18835-wallets-destroyed
description: ""
status: "confirmed by the vendor (Keystone incident statement, Oct 26)"
published: 2026-10-26
---

> 

[← Cybersecurity News](/news) · [markdown](/items/keystone-webauth-device-key-stolen-18835-wallets-destroyed.md)

confirmed by the vendor (Keystone incident statement, Oct 26)

2026-10-26

### Keystone says the website intruder also stole the key that proves its hardware wallets are genuine, so it will destroy 18,835 devices in stock; 25,964 buyer records exposed

Keystone's Oct 26 statement expands its [Oct 24 disclosure](/items/keystone-hardware-wallet-shopify-shipping-data-breach). The attacker who got into its website on **Oct 20** exploited a vulnerability in a **third-party data monitoring tool** on the site to escalate privileges (the tool isn't named).

- **Device authentication key stolen.** The attacker obtained the WebAuth key used by `keyst.one/authentication` to check whether a device is genuine. It is written in at manufacture and can't be changed. It plays no part in seed generation, key derivation or signing, but it would let someone build **counterfeit wallets that pass Keystone's authenticity check**. Keystone has switched production to a new key, will destroy the **18,835** devices in inventory that carry the old one, and has paused shipping of website orders (sales move to preorder).
- **Customer data:** **25,964** Shopify buyer records from 2024 to 2026 with names, contact details, shipping addresses and orders, plus **12,873** abandoned-checkout records. Keystone admits its 180-day deletion tool silently failed, so data was kept longer than promised. It is cutting retention to 90 days. Recovery phrases, private keys, payment data and ID numbers weren't involved.

**If you own one:** a device delivered **before Oct 20** that passes authentication is fine. If you received an old-key device **after Oct 20**, contact Keystone support for extra verification before use, even if it passes. Keystone won't ask for returns, so treat any "recall", "asset migration" or "wallet verification" contact as a scam. Expect targeted phishing at the leaked shipping addresses.

Sources: [Keystone on X: Statement regarding the security incident on our official website (Oct 26)](https://x.com/KeystoneWallet/status/2114719318722404578)