Keystone disclosed on Oct. 26, 2026, that attackers stole the key used to authenticate its hardware wallets. The company plans to destroy 18,835 unsold devices containing the key because it cannot be changed or erased. Keystone warned that counterfeit devices could pass its checks, and it has suspended shipments of outstanding website orders while replacement devices are made.
Keystone said personal information remained in 25,964 of 51,083 buyer records examined after its data-deletion system failed. It also identified 12,873 unpaid checkout records containing potentially sensitive information. The company says recovery phrases, private keys, wallet credentials and payment information were not compromised. It says devices delivered before Oct. 20 remain safe to use if they pass authentication, but devices received afterward with the compromised key need additional verification through customer support even if they pass.
