Keystone hardware wallet authenticity key stolen in website breach
Keystone hardware wallets (device authentication key) and keyst.one store
An attacker who broke into hardware wallet maker Keystone's official website, detected on October 20, exploited a vulnerability in a third-party data monitoring tool to escalate privileges and stole the WebAuth key Keystone uses to verify that its devices are genuine. With that key, counterfeit wallets could pass Keystone's official authenticity check, which Keystone warns could lead to asset theft. The key is burned in at manufacture and can't be changed, so Keystone will destroy the 18,835 devices in inventory that carry it, has moved production to a new key and paused website shipping. The attacker also got 25,964 Shopify buyer records (names, contact details, shipping addresses, orders) plus 12,873 unpaid checkout records. Recovery phrases, private keys, payment details and the firmware signing key were not affected, and no counterfeit devices or thefts have been reported.
Why this severity: Device authenticity key stolen, so counterfeit wallets could pass the official check; 25,964 buyer addresses exposed
- Started
- Oct 20, 2026
Affected
- Keystone hardware wallets received after October 20, 2026 that carry the old device authentication (WebAuth) key
- 25,964 buyer records from Keystone's official Shopify store (2024 to 2026) and 12,873 unpaid checkout records
Fixed in
- Newly manufactured Keystone devices with a new authentication key
Timeline3
Keystone's full statement: the attacker exploited a vulnerability in a third-party data monitoring tool on the website to escalate privileges and also stole the WebAuth key used to verify that devices are genuine. 25,964 Shopify buyer records (2024 to 2026) and 12,873 unpaid checkout records were exposed. The 18,835 devices in inventory with the old key will be destroyed, new devices get a new key, and website shipping is paused.
Keystone first discloses the breach as a leak of customers' shipping information and asks Shopify to erase buyer data past its retention period.
Keystone's security monitoring detects unusual access to its official website; it disables sensitive site functions, blocks the access points the same day and fixes the vulnerability.
Advisories1
News & write-ups2
Posts1
Notes & caveats
Keystone says the WebAuth key is used only for the authenticity check, not for seed generation, key derivation or signing, and that its firmware signing key is separate and was not affected. Overdue buyer data is due to be erased by Shopify on November 3, 2026; Keystone is cutting retention from 180 to 90 days and has reported the incident in the EU, UK and other jurisdictions. It hasn't named the monitoring tool or said when the attacker first got in.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
