Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Key

A Website Breach Forces Keystone to Scrap Its Entire Inventory

Hardware wallet maker Keystone said on Monday it will destroy 18,835 unsold devices and suspend shipments after confirming that an attacker who broke into its website also stole the key used to verify its wallets as genuine. What first looked like a customer data leak has become one of the most unusual recalls in crypto security.

Keystone first confirmed on Oct. 25 that an attacker had taken customer shipping information. A fuller statement posted on X the next day revealed the second, more serious loss: a cryptographic key embedded in every device that cannot be changed after manufacture.

What the Attacker Took: 25,964 Buyer Records and a Factory Key

According to Cointelegraph, the intrusion happened on Oct. 20, when the attacker exploited a vulnerability in a third-party monitoring tool used by Keystone’s website to escalate their access. From there, they reached two things.

The first was customer data. Keystone’s Shopify store had generated 51,083 buyer records. Some 25,119 had been deleted under the company’s 180-day retention policy, but 25,964 records from 2024 to 2026 remained and may have been stolen, including names, contact details, shipping addresses and order information. A further 12,873 checkout records from incomplete purchases may also have been accessed.

The second was the authentication key. Keystone stressed that recovery phrases, private keys and wallet credentials were not exposed. The stolen key does not open anyone’s wallet, but it is arguably more dangerous for future buyers.

Why One Stolen Key Means 18,835 Devices Must Be Destroyed

Here is the mechanism in plain terms. When a hardware wallet is manufactured, the maker burns a secret key into the device. When a customer sets it up, the companion app challenges the device to prove it holds that key, and marks it as genuine if it answers correctly. This check should prevent a tampered or counterfeit wallet from ever being trusted.

Because the Keystone key is fixed in hardware and cannot be rewritten, every device carrying it is now in a strange position. The devices are not broken, but anyone holding the stolen key could build a fake wallet that passes the same test, then sell or ship it to someone who, in Keystone’s words, “might unknowingly use them as genuine products.”

That is why the company has chosen to destroy its entire inventory of 18,835 units rather than ship them. New devices will carry a replacement key, and website sales are moving to preorders until that production line is running. Keystone has described the counterfeit scenario as a risk, not a confirmed event.

What Keystone Owners Should Do Now

The guidance is clearer than the headline suggests. Any device made and delivered before Oct. 20 is considered safe to use, and its authenticity check remains trustworthy, because no counterfeit could have existed before the theft.

Customers who received a device after Oct. 20 are being asked to contact Keystone’s support team for additional verification before use. Keystone said users do not need to move funds because of this breach alone.

The sharper risk for the 25,964 affected buyers is social engineering, since attackers now know who owns a hardware wallet and where they live. Keystone warned customers to ignore fake recall notices or “asset migration” messages, the standard follow-up to any leak of this kind. Anyone who tracks the latest crypto news will recognise the pattern from previous wallet breaches.

A Data Deletion Tool That Quietly Failed

The breach also exposed a process failure unrelated to the hacker. Keystone’s 180-day retention policy existed on paper, but the automated bulk-erasure tool meant to enforce it had stopped working unnoticed. “The tool did not operate reliably,” the company said.

Keystone did not soften the admission. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” it wrote, according to CoinDesk. Retention is now being cut from 180 days to 90.

The Latest in a Run of Hardware Wallet Scares Since July

Keystone’s problem lands in an already bruised sector. Earlier this month, Ledger asked resellers in Southeast Asia and Hong Kong to suspend sales after confirming hardware implants in tampered devices that captured recovery phrases during setup. In late July, a flaw in Coldcard’s seed-generation software let attackers reconstruct private keys and drain wallets remotely, with losses later estimated at $116 million.

Trezor’s shipping partner was breached in August, affecting more than 80,000 users, and a day before Keystone’s announcement, Foundation reported more than 23,000 phishing attempts spoofing its domains. The common thread is not the chips but the supply chain and customer databases around them. For anyone who wants to buy crypto and hold it offline, the device is now only one part of the risk picture.

Will Preorders and a New Key Restore Buyer Confidence?

Keystone’s decision to destroy stock rather than quietly sell through it could be the right reputational call, but it carries a real cost. Shipments are paused with no public restart date, and rivals may pick up buyers unwilling to wait for preorders.

The move may also set an expectation other makers would struggle to match. If a competitor suffers a similar key compromise, customers could now ask why its inventory was not destroyed too. Much depends on whether Keystone’s replacement key arrives quickly and whether any counterfeit devices surface in the meantime.

Cold Storage’s Weak Point Has Moved Off the Chip

Hardware wallets were built to solve one problem: keeping private keys away from internet-connected machines. On that measure, Keystone’s devices still work, and existing owners can carry on using them.

The breach shows that the trust model around a hardware wallet extends far beyond the hardware. A monitoring tool on a marketing website, a deletion script that silently failed, and a Shopify store full of home addresses proved to be soft targets. A run of incidents since July suggests attackers have worked this out faster than the industry has, and that the next upgrade in cold storage may need to be organisational rather than cryptographic.