Crypto wallet maker Keystone to destroy almost 19,000 devices after security breach

Keystone, a crypto wallet maker, intends to destroy nearly 19,000 unsold units following a website breach.

The security incident exposed 25,964 buyer records. Some of this data remained past Keystone’s 180-day deletion policy because an automated tool malfunctioned without the company noticing.

The exploit contributes to a series of attacks against hardware wallet users. Keystone stated that an attacker accessed its website on Oct. 20 via a flaw in a third-party data monitoring tool, according to a post on X made Monday.

The intrusion revealed 25,964 buyer records spanning 2024 through 2026, including shipping addresses, order information, names, and contact details. Additionally, 12,873 unpaid checkout records might have been impacted.

The stolen Keystone key, which is embedded during production, permits wallets to pass online authenticity checks. This heightens the danger that counterfeit devices could appear legitimate, putting user funds at risk, per the firm.

Keystone announced it will destroy 18,835 unsold units. The company confirmed the breach did not expose wallet credentials, private keys, or recovery phrases.

Keystone admitted, “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.”

The company stated that devices shipped before Oct. 20 are safe if they pass authentication. Customers who received devices using the old key after that date should conduct further checks before using them.

Keystone plans to replace the authentication key in new devices, move website sales to preorders, and reduce customer data retention to 90 days.