Bitcoin hardware wallet manufacturer Keystone said that, after attackers obtained the keys used to verify the authenticity of its hardware, the company will destroy 18,835 unsold devices. The company has also paused shipping for all outstanding orders on its website.
For buyers, the risk is that a counterfeit wallet may appear brand new and pass Keystone’s own verification checks, because the attacker has obtained the keys required for those checks. Criminals may then sell such devices to users who intend to store their real assets on them.
Keystone stated: "If this key is compromised, attackers could use it to create counterfeit devices that pass authentication checks. These devices could then be sold or shipped to customers, who might unknowingly use them as genuine, ultimately leading to asset theft."
Keystone refers to this key as the WebAuth key—a secret code written into each device at the factory, allowing websites to verify the authenticity of the hardware. This key cannot be erased or rewritten, and the 18,835 devices in inventory carrying this key will be destroyed rather than sold.
Keystone initially stated on Saturday that third parties had obtained customers' shipping information. Monday's statement added that, in addition to the stolen keys, there were 25,964 affected buyer records; however, the company did not identify the responsible party or specify when the attacker first breached the system.
This incident affected Keystone’s Shopify store records, the e-commerce platform responsible for its online sales. Keystone stated that a total of 51,083 buyer records were impacted; however, 25,119 of these contained personal information that has been deleted. The remaining 25,964 records, from 2024 to 2026, still retain names, contact details, shipping addresses, and order information. Purchases made through Amazon and other channels were not affected.
Some of this data should have already been deleted. Keystone’s policy is to delete buyer records after 180 days, but the automated batch deletion tool developed by the company was unstable.
Keystone stated: "Some deletion tasks failed, and we did not detect or address these failures in a timely manner, resulting in certain personal information being retained beyond the permitted period. We failed to fulfill our commitment to delete customer data on time and take responsibility for this failure."
Customer lists have consistently been a recurring vulnerability for wallet manufacturers. Ledger’s 2020 data breach ultimately affected approximately 292,000 customers, many of whom, after receiving phishing emails, feared they might become targets of home invasions.
Trezor and SafePal also disclosed customer data breaches in August, affecting 13,689 and approximately 39,798 customers, respectively.
Name and address are important because of "wrench attacks"—criminals use threats or violence to force holders to surrender their crypto assets. According to Chainalysis, 46 violent attacks occurred in the first half of 2026, resulting in the theft of over $30 million.
The manufacturer also warned that scammers may offer so-called "asset migration," "wallet verification," or "investigative assistance."
The company stated: "We will not ask you to return the device. Anyone who contacts you claiming it is a 'recall' and asks you to ship the device to them should be considered a scammer."
Sales on the Keystone website will be changed to pre-orders until devices produced with the new key are completed. The company also stated that it has filed reports with regulatory authorities in the European Union, the United Kingdom, and other jurisdictions.
Keystone has reduced the customer data retention period from 180 days to 90 days and requested Shopify on October 24 to delete all buyer data retained beyond this period. The process includes a 10-day waiting period, and the company expects the deletion to be completed by November 3.