Keystone pulls wallets, affects 25,964 buyer records after key theft

A counterfeit wallet that appears brand new and passes Keystone’s own security checks is the risk facing buyers after an attacker managed to seize the permanent factory key used to verify the authenticity of the hardware. The Bitcoin wallet manufacturer, Keystone, announced Monday that it is going to destroy 18,835 unsold units because this key fell into malicious hands. Furthermore, the firm has halted the shipment of all outstanding orders from its online storefront.

This security lapse, which was first noticed on October 20, also impacted the records of 25,964 customers from Keystone's Shopify platform, covering the period from 2024 through 2026. The company stressed that neither the private keys nor the recovery phrases associated with the wallets were compromised.

Keystone explained that the stolen key is what enables the fraudulent devices to pass the verification process; "If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks," the company stated in its official communication. "These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft." This verification method relies on a WebAuth key, a secret code embedded during the manufacturing process that allows the company’s website to confirm the hardware's legitimacy, a feature that cannot be altered or removed.

The company initially disclosed on Saturday that a third party had acquired customer shipping details. The Monday announcement expanded this by adding the detail about the stolen key and the count of 25,964 affected records, though it offered no information regarding the perpetrator's identity or the exact timing of the intrusion. The affected records reside within the e-commerce platform that managed its online sales. While Keystone initially cited 51,083 buyer records involved, 25,119 of those had already had their personal data deleted, leaving the 25,964 records spanning 2024 to 2026 that still contained names, contact information, shipping addresses, and order specifics. Purchases made via Amazon and other sales channels were not affected by this incident.

Regarding the data retention, Keystone admitted that some customer information should have already been purged. The firm’s procedure was to eliminate buyer records after 180 days, but the automated bulk-deletion tool implemented for this purpose proved unreliable. Keystone confessed, "Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period." They added, "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure."

Customer lists represent a persistent vulnerability for wallet manufacturers. For instance, a data leak involving Ledger back in 2020 ultimately exposed information pertaining to roughly 292,000 patrons, leading to fears among those who subsequently received phishing emails that they could become targets of physical assaults. Additionally, Trezor and SafePal each reported customer data breaches in August, affecting 13,689 and approximately 39,798 customers, respectively. Personal details like names and addresses are significant because they facilitate "wrench attacks," where criminals employ coercion or force to compel owners to relinquish their cryptocurrency. Chainalysis documented 46 such violent incidents in the first half of 2026 alone, resulting in over $30 million being stolen. The manufacturer also cautioned users about scammers who might offer services such as "asset migration," "wallet verification," or "investigation assistance," advising, "We will not ask you to return your device," and warning that anyone contacting them under the guise of a "recall" and requesting the device's shipment should be considered a scammer.

Until production can resume using a new key, sales on Keystone's website will be limited to preorders. The company has notified relevant authorities in jurisdictions including the EU and the UK. Furthermore, Keystone has reduced its customer data retention window from 180 days down to 90 days and requested that Shopify delete all overdue buyer data on October 24, setting a 10-day waiting period, with the erasure anticipated to conclude on November 3.

Why it matters

This incident highlights the severe risk of counterfeit hardware entering the market, potentially leading to asset theft for users. Readers should be wary of any unsolicited contact regarding a 'recall' or device verification from Keystone or other wallet makers.