Keystone says stolen authentication key could let counterfeit wallets pass checks

Reporting: sourced factual coverage reviewed by the editorial desk.

Keystone says an attacker stole the key used by its website to verify hardware wallets, warning that a counterfeit device could pass an authenticity check. The wallet maker says it will destroy 18,835 unsold devices containing the old key and has suspended shipments of unfilled website orders while it prepares devices with a replacement key.

In its October 26 statement, Keystone said it detected unusual access to its official website on October 20. The company attributes the intrusion to a vulnerability in a third-party monitoring tool and says the attacker obtained the authentication key and customer information. These are Keystone’s findings; RailsRecord has not independently examined the incident or affected devices.

The distinction matters: the compromised WebAuth key checks whether a device is genuine. Keystone says it is not used to generate recovery phrases, derive wallet private keys or sign transactions, and that those wallet credentials were not involved in the incident. A successful authenticity check for a device using the exposed key, however, is no longer sufficient on its own to rule out a counterfeit device received after October 20.

Keystone advises customers who received an old-key device after October 20 to contact its official support through the instructions on its authentication page and use the device only after additional verification. It says devices delivered before October 20 can be used normally if they pass authentication. The company says customers need not move assets solely because of this incident and warns against unsolicited migration, verification and recall messages. Never disclose a recovery phrase to anyone offering help.

The company says 25,964 purchase records retained personal information, including names, contact details, shipping addresses and order information. It also identified 12,873 incomplete checkout records containing submitted contact and shipping details, which it is treating as potentially affected. The figures are records, not necessarily distinct people. Keystone says requests to erase overdue data were submitted on October 24 and that completion is expected November 3, subject to Shopify’s waiting period.

Keystone says it has stopped using the old key in production and will switch website sales to preorders until devices using the new key are ready. Destruction, deletion and later shipping are planned actions, not outcomes independently verified by RailsRecord. The incident illustrates a separate risk from the theft of wallet keys: a compromised authenticity check can undermine confidence in the device before anyone signs a transaction.

Sources & evidence

Keystone Hardware Wallet — October 26 incident statement ↗

Author disclosure

AI assisted research, drafting and review of Keystone’s original statement. RailsRecord did not independently audit the incident or interview affected customers. RailsRecord is a Joaico publication; material publisher holdings have not been established.

Corrections

Identify this article and the disputed claim in a correction request to corrections@railsrecord.com ↗. The publisher reviews supporting primary evidence.