Keystone said it will destroy 18,835 unsold hardware wallets and has suspended shipping unshipped website orders after an attacker obtained a permanent factory key used to verify its devices. The company said the key could let counterfeit wallets pass its authentication check, but said recovery phrases and private keys were not involved and devices delivered before October 20 are unaffected.
Keystone said the breach, detected October 20, also left personal information in 25,964 Shopify buyer records from 2024 to 2026 exposed, including names, contact details and shipping addresses. Purchases through Amazon and other channels were not affected. The company said a faulty deletion process had left some buyer data on file beyond its 180-day retention period; it did not say who was responsible for the breach or when the attacker first gained access.
