Hardware wallet maker Keystone said an attacker who breached its website stole customer data and a key used to verify its devices. The company said the stolen key could let counterfeit wallets pass authenticity checks, potentially putting users’ assets at risk. Keystone said devices manufactured and delivered before the Oct. 20 incident should be considered safe, but it could not guarantee the authenticity of devices delivered afterward and urged those customers to seek additional verification.
Keystone said it has suspended shipments of devices using the key and plans to destroy 18,835 such devices in its inventory. Shipments will resume once it begins producing devices with a new key. The company also said the attacker stole 25,964 buyer records dating from 2024 to 2026 and another 12,873 checkout records from purchases that were not completed.
