ChainThink reports that on October 26, according to an official announcement, the hardware wallet Keystone stated that attackers exploited a vulnerability in a third-party data monitoring tool on its official website to obtain WebAuth keys used to verify device authenticity, potentially enabling the creation of counterfeit devices that can pass verification.
Keystone has ceased production using the old keys, will destroy 18,835 devices in inventory that use the old keys, and has paused all unfulfilled orders on its official website, switching to a pre-order model.
Keystone states that devices received and verified before October 20 can be used normally; for old key devices received after October 20, even if verified, users must contact customer service for further verification—users do not need to return the devices.
This incident involved 25,964 Shopify purchase records containing personal information and 12,873 incomplete checkout records.
Keystone stated that the relevant information was originally supposed to be deleted after 180 days, but was retained longer due to a failure in the automated deletion tool; the retention period for personal information has now been shortened to 90 days. Mnemonics, private keys, and payment information were not compromised.