This key is written into wallets during manufacturing and cannot be erased or overwritten. The company assured that the key is not used to generate seed phrases, create private keys, or sign transactions.
However, by obtaining the key, an attacker can create counterfeit devices that successfully pass Keystone’s authentication checks. If such fake devices reach customers who mistake them for genuine Keystone products, those customers will lose their crypto assets.
Keystone is completely discontinuing the use of the old key. All new devices will be released with a new authentication key. The company has promised that 18,835 hardware wallets in inventory containing the compromised key will be destroyed and will not be sold. Keystone has paused shipment of all unpaid devices ordered through its official website and has switched sales to pre-order mode until production of devices with the new key is restored.
On October 20, Keystone monitoring systems detected suspicious activity on the website. An unknown actor exploited a vulnerability in the data monitoring tool. As a result of the incident, personal data of 25,964 customers who placed orders on the Shopify platform between 2024 and 2026 were compromised. Names, contact details, delivery addresses, and order information were exposed. Fortunately, the attacker did not gain access to users' seed phrases, private keys, or payment information.
According to Keystone's internal policy, customer data must be deleted after 180 days, but the company's representatives claim that an automated bulk deletion tool malfunctioned. They acknowledged that the compromised data was not deleted on time. The hacker gained access to 12,873 records of incomplete orders, which also contained names, contact details, and delivery addresses.
Devices delivered before October 20 are considered usable by the manufacturer, provided they pass authenticity verification. Customers who received a wallet with the old key after October 20 are advised to contact customer support for additional verification. Even if a device passes authentication, the possibility that it is a counterfeit cannot be ruled out.
The company announced that it will not ask wallet owners to return their devices. Anyone requesting that a wallet be sent in for replacement is declared a scammer.
Previously, another major hardware wallet manufacturer, Ledger, acknowledged that a group of hackers specifically purchased devices. The attackers opened the wallets and installed hidden modules to intercept seed phrases. Wallets with spy modules appeared even on the Russian marketplace Ozon.