Keystone to destroy 18,835 wallets after verification key theft
Original title: Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
The breach exposed 25,964 buyer records; devices received after October 20 with the old key need confirmation.
Keystone said an attacker who reached its website on or before October 20 stole the key hardware wallets use to prove they are genuine, plus customer data. The company will destroy 18,835 unsold devices that carry the key and issue a new key; recovery phrases and wallet private keys were not involved. It says a vulnerability in an unnamed third-party monitoring tool was used to escalate privileges, then fixed, and reports no counterfeit devices or thefts.
Unconfirmed: Keystone has not said when access began, where the key was stored, or how owners can tell which key a device carries, and reports no confirmed counterfeits.
- Buyer records from 2024 to 2026 include names, contacts, shipping addresses, and orders.
- Payment cards, bank details, and government IDs were not involved.
- Amazon and other sales-channel purchase records were not affected.
- 12,873 unpaid checkout records were included as a precaution.
- Shopify is to delete buyer data older than 90 days, expected November 3.
Impact: Verification key and shipping records for 25,964 buyers
- 1.Do not use a device received after October 20 with the old key until Keystone support confirms it.
- 2.Treat unsolicited refund, replacement, recall, or wallet-verification messages as scams.
- 3.Type keyst.one directly and never enter a recovery phrase on a device you did not order.
- Vendors
- Keystone
- Products
- Keystone 3 Pro
- Victims
- Keystone
- Organizations
- Shopify
From the original article
4 min read at thehackernews.com
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.