Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes

The company is destroying 18,835 unsold hardware wallets and has paused shipments after an attacker acquired the permanent factory key used to confirm the authenticity of its devices.

Keystone, which manufactures Bitcoin hardware wallets designed to keep secret codes for cryptocurrency offline, reported on Monday that the theft of this key poses a risk of counterfeit wallets, as the attacker can create devices that pass Keystone's own verification checks. This breach, which was identified on October 20, impacted the records of 25,964 buyers from Keystone's Shopify store, covering the period from 2024 through 2026, and encompassing names, contact information, and shipping locations.

The risk involves a criminal potentially selling a counterfeit wallet that appears brand new and successfully passes the verification process, allowing someone to load actual savings onto it. Keystone stated, "If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks," adding, "These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft."

The key that the verification process relies upon is what the attacker obtained; Keystone describes this key as a WebAuth key, a secret code embedded during the factory manufacturing process that permits a page on the company's website to verify the hardware's authenticity. This code is immutable, meaning it cannot be altered or removed, and consequently, the 18,835 units currently in inventory possessing this key are slated for destruction instead of being sold.

The firm initially announced on Saturday that a third party had managed to obtain customer shipping data. Monday's update further specified the theft of the key and quantified the 25,964 affected buyer records, though it did not specify the responsible party or the exact timing of the initial intrusion. The records affected were those held by Keystone’s Shopify storefront, the platform managing its online sales.

While Keystone mentioned that 51,083 buyer records were implicated in total, 25,119 of those had already undergone personal information erasure, leaving the remaining 25,964—dating from 2024 to 2026—retaining names, shipping addresses, contact details, and order specifics. Sales conducted via Amazon and other sales channels were not impacted by this incident.

Keystone acknowledged a failure in its data management procedures, explaining that some of the data erasure tasks failed and that these failures were not detected or addressed promptly, leading to certain personal information remaining past the allowed timeframe. The company stated, "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure."

This issue of customer lists being vulnerable is a problem that wallet manufacturers face recurrently; for instance, a leak involving Ledger in 2020 eventually reached approximately 292,000 customers, and individuals who subsequently received phishing emails expressed concerns about becoming targets of home invasions. Furthermore, Trezor and SafePal each disclosed customer data breaches in August, affecting 13,689 and about 39,798 customers, respectively.

The importance of names and addresses is underscored by "wrench attacks," whereby criminals use threats or physical force to compel owners to surrender their cryptocurrency holdings. Chainalysis documented 46 violent attacks during the first half of 2026, resulting in over $30 million being stolen. Additionally, the manufacturer cautioned against scammers who offer services such as "asset migration," "wallet verification," or "investigation assistance," advising, "We will not ask you to return your device," and warning that "Anyone contacting you under the pretext of a ‘recall’ and asking you to ship your device to them should be treated as a scammer."

Until production resumes using a new key, sales on Keystone’s website will be limited to preorders. The company has informed authorities in the EU, the UK, and other relevant jurisdictions about the situation. Keystone has reduced its customer data retention period from 180 days to 90 days and formally requested that Shopify erase all outstanding buyer data on October 24, with a stipulated waiting period of 10 days, anticipating the completion of this erasure on November 3.