Keystone Hackers Steal Key Used to Verify Wallets
Ecosystem
English
News
Markets
Features
Research
Opinion
Podcasts
Newsletters
Commissioned
About
- DOGE: $0.07761 (1.42%)
- TRX: $0.3295 (0.22%)
- LINK: $11.32 (0.36%)
- ZEC: $1,226.86 (2.46%)
- ADA: $0.2047 (1.40%)
- XRP: $1.30 (1.02%)
- ETH: $2,319.13 (0.53%)
- BTC: $79,990.72 (0.44%)
- XMR: $609.50 (3.41%)
- BNB: $741.90 (0.54%)
- XLM: $0.1687 (0.75%)
- SOL: $100.51 (0.34%)
- HYPE: $78.06 (2.94%)
Written by Felix Ng (staff editor)
Edited by Yohan Yun (staff editor)
Keystone Breach Deepens: Hackers Steal Key for Wallet Verification
Latest News
Published: Oct 27, 2026
Keystone initially disclosed a leak of customer information but has since revealed that hackers also stole a key crucial for verifying the authenticity of its hardware wallets.
Hardware wallet maker Keystone announced an attacker who breached its website last week also stole a key that could enable counterfeit wallets to bypass authenticity checks.
In a statement on Monday, Keystone explained:
"These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft."
The incident amplifies a series of attacks targeting hardware wallet manufacturers this year. Earlier this month, Ledger asked resellers in Southeast Asia and Hong Kong to halt sales after reports of unauthorized implants in devices sold in the region. In late July, Coldcard manufacturer Coinkite issued a warning about a bug that led to the theft of millions in crypto.
Keystone's Response
Keystone plans to destroy over 18,835 devices in its inventory that contain the compromised key and has suspended production shipments of all devices using it. They will resume shipments once they begin producing devices with a new authentication key.
The company assures that devices manufactured and delivered before the October 20 incident are safe and their authenticity checks remain reliable. However, they cannot guarantee the authenticity of devices delivered after that date and advise affected customers to contact their support team for additional verification.
Keystone also disclosed the extent of the customer data breach, revealing that its Shopify store generated 51,083 buyer records. Of these, 25,964 records from 2024 to 2026 were stolen by the attacker. The remaining 25,119 records, dating from 2024 to 2026, had been deleted according to their 180-day data retention policy.
Additionally, the attacker accessed 12,873 customer checkout records retained by Shopify—information from purchases that had not been completed. Keystone has contacted Shopify to request the deletion of personal information in checkout records retained for over 30 days.