Hardware wallet manufacturer Keystone has confirmed that hackers stole a security key used to authenticate its devices, an incident the company says allowed attackers to produce counterfeit wallets capable of passing as genuine during the authentication process. The warning was first published by Keystone in a message on X.
The company had initially reported only that customer data had been stolen. It has since acknowledged the more serious implication of the breach: that the stolen key undermines the mechanism customers rely on to confirm a device has not been tampered with.
According to Keystone, the attackers exploited a vulnerability in an external monitoring tool used on its website to expand their access rights within the company's systems. That access ultimately led to the compromise of the authentication key.
Thousands of devices to be destroyed
In response, Keystone said it will destroy 18,835 devices currently held in its warehouse stock. Deliveries of the affected models have been halted and will only resume once new devices are produced using a replacement key.
Keystone said hardware wallets manufactured and delivered before the attack, which it dates to October 20, are still considered secure. For units shipped after that date, the company said it cannot guarantee authenticity, and it is urging affected customers to contact support for additional verification.
Keystone sought to reassure existing owners that no physical return of devices is required. "We will not ask you to send back your device," the company said.
Customer data also exposed
Separately, Keystone disclosed that the attackers may have stolen 25,964 buyer data records spanning 2024 to 2026, with a further 12,873 records tied to incomplete orders potentially also affected. The company said a faulty deletion system had prevented certain customer data from being removed in time, extending the window of exposure.
"We have failed to meet our obligation to delete customer data in a timely manner and take responsibility for that," Keystone said. In response, the company is shortening the retention period for personal customer data from 180 to 90 days, and said overdue data held at Shopify is to be deleted by November 3.
Part of a wider pattern
The Keystone incident follows other recent security problems among hardware wallet makers. A vulnerability in Coldcard's firmware became known in July 2026, through which attackers could predict seed phrases; estimates suggest between 1,300 and 1,800 Bitcoin were stolen as a result. Ledger has also recently come under attack, with the manufacturer's supply chains targeted.
The string of incidents underscores the challenges hardware wallet makers face in securing not only their devices but the supply chains and digital infrastructure surrounding them, at a time when such wallets are marketed as the more secure alternative to software-based storage of crypto assets.
