Keystone: Hackers Stole the Key That Proves Its Wallets Are Real, So 18,835 Will Be Destroyed

On 21 October 2026, Keystone told its 66,000 followers on X that a rival's trouble was "a wake-up call for every hardware wallet maker. Us included." The rival was Ledger, whose devices had been tampered with on their way to buyers in Southeast Asia. Keystone promised to audit its own supply chain. What it did not say was that, the day before, its security systems had spotted a stranger inside its own website.

Five days later the company published the bill. The intruder had taken the personal details of 25,964 buyers, plus 12,873 people who had started an order and never paid. Worse, the intruder had taken the one secret that lets Keystone tell a real Keystone from a fake. Because that secret is built into every device at the factory and can never be changed, Keystone said it would destroy all 18,835 unsold devices in its warehouse, stop shipping website orders and sell only on preorder until a new batch is made.

No crypto has been reported stolen. Keystone says no recovery phrases, private keys, bank details or ID numbers were taken. The damage is to trust, and to stock. Keystone has not said what the destroyed devices are worth.

What a hardware wallet is, and what was stolen

Crypto is controlled by a private key, a long secret number that works like the signature on a bank account. Whoever has it can move the money. A hardware wallet is a small device, about the size of a phone or a USB stick, that keeps that key inside a sealed chip and never lets it touch the internet. It is a pocket safe. Keystone's flagship, the Keystone 3 Pro, goes further than most: it signs payments with no cable or Bluetooth link, swapping QR codes with a phone instead, so the key stays cut off from the internet.

A safe is only as good as the confidence that it came from the real locksmith. Criminals know this, which is why they sell doctored wallets that look genuine but quietly send the owner's key to the thief. To fight that, Keystone runs a check on its website, called WebAuth. The buyer goes to keyst.one, the site asks the device a question, and the device answers using a secret key written into it at the factory. A correct answer means the device is genuine. It works like the hologram on a banknote or the seal on a bottle of medicine.

That factory key is what the intruder took. With it, a counterfeiter can build a fake wallet that gives the right answer and passes Keystone's own test. Keystone's statement put it plainly: such devices "could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft." The key cannot be rewritten on devices already built, so every unsold unit carrying it became worthless as a guarantee. Hence the shredder.

How the intruder got in

According to Keystone, the attacker found a flaw in a third-party data monitoring tool running on the company's website, and used it to "escalate privileges", which means turning a visitor's pass into a manager's keys. Keystone has not named the tool or the attacker, and no group has claimed the attack. It has also not explained why a key built into every device was reachable from a web server at all. For the website to check devices, it had to hold the key, or a way to use it, so the shop window and the crown jewels sat closer together than buyers might have assumed.

The customer data came from Keystone's Shopify store, the online shop software used by millions of small businesses. Keystone said the store held 51,083 buyer records. Of those, 25,119 had already been wiped under its rule of deleting personal data after 180 days. The other 25,964, from 2024 to 2026, should also have been gone. Keystone had built a tool to delete them in bulk, because Shopify makes merchants erase records one at a time. The tool failed quietly and nobody noticed. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure," the company wrote. Orders placed through Amazon and other shops were not affected.

Two statements, two stories

Keystone told the story in two halves. Its first post, on 24 October, said it had confirmed on 23 October, after checking the store's activity with Shopify, that a third party had taken names, contact details, shipping addresses and order details. It said nothing about the authentication key and promised "a detailed report". That report came on 26 October, as a long statement on X headed "Statement Regarding the Security Incident on Our Official Website and Customer Guidance". It added the key, the 18,835 devices and the shipping freeze. Cointelegraph's headline the next day called it a breach that "deepens".

What owners should do

Keystone draws the line at 20 October 2026, the day it spotted the intrusion. Devices delivered before then were made and shipped before the key leaked, so if one passes the WebAuth check, it can be treated as genuine. A device received after 20 October that carries the old key is different. Even if it passes the check, Keystone says it "cannot completely rule out the possibility that it is counterfeit", and the owner should contact Keystone support for extra verification before putting any money on it.

Keystone also says owners do not need to move their crypto because of the breach alone. The bigger risk is the leaked address list. A list of people who bought a crypto safe is a list of people who probably own crypto, and those lists get used. Keystone warned of calls and messages offering "asset migration", "wallet verification" or a "recall". It says it will never ask for a device back, never ask for a recovery phrase, and that anyone who asks for either is a scammer. Its advice is to type keyst.one by hand rather than click links.

A bad season for the safes

Keystone is the latest in a run of hardware wallet makers hit in 2026, and the attacks come from every side. Coldcard, made by Coinkite in Toronto, saw about $116 million drained in July after a flaw in how its devices created keys. Trezor lost customer data in August when attackers broke into ShipMonk, the company that posts its boxes. SafePal said on 16 August that a flaw in an order-tracking plug-in exposed about 39,798 customers. In October, Ledger asked resellers in Southeast Asia to pause sales after reports of devices fitted with hidden implants. On 25 October, the day before Keystone's full statement, Foundation, the Boston maker of the Passport wallet, disclosed its own breach, according to CoinDesk.

The pattern is older than this year. In 2020 a breach of Ledger's online shop leaked more than a million email addresses and the full names, phone numbers and home addresses of about 272,000 customers, and Ledger owners received fake letters, phishing emails and threats for years afterwards.

What makes Keystone's case different is that the attacker took more than a mailing list. The company sells a promise that buyers need not trust anyone, and the proof of that promise was a key on its own web server.