Keystone hardware wallet authenticity key stolen in website breach ยท updates https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026 An attacker who broke into hardware wallet maker Keystone's official website, detected on October 20, exploited a vulnerability in a third-party data monitoring tool to escalate privileges and stole the WebAuth key Keystone uses to verify that its devices are genuine. With that key, counterfeit wallets could pass Keystone's official authenticity check, which Keystone warns could lead to asset theft. The key is burned in at manufacture and can't be changed, so Keystone will destroy the 18,835 devices in inventory that carry it, has moved production to a new key and paused website shipping. The attacker also got 25,964 Shopify buyer records (names, contact details, shipping addresses, orders) plus 12,873 unpaid checkout records. Recovery phrases, private keys, payment details and the firmware signing key were not affected, and no counterfeit devices or thefts have been reported. en Mon, 26 Oct 2026 00:00:00 GMT Keystone hardware wallet authenticity key stolen in website breach: Keystone's full statement: the attacker exploited a vulnerability in a third-party data monitoring tool on the website to escalate privileges and also stole the WebAuth key used to verify that devices are genuine. 25,964 Shopify buyer records (2024 to 2026) and 12,873 unpaid checkout records were exposed. The 18,835 devices in inventory with the old key will be destroyed, new devices get a new key, and website shipping is paused. https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026 https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026#2026-10-26-0c470287 Mon, 26 Oct 2026 00:00:00 GMT high <p><a href="https://x.com/KeystoneWallet/status/2114719318722404578">Source</a></p> Keystone hardware wallet authenticity key stolen in website breach: Keystone first discloses the breach as a leak of customers' shipping information and asks Shopify to erase buyer data past its retention period. https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026 https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026#2026-10-24-e353a55c Sat, 24 Oct 2026 00:00:00 GMT high <p><a href="https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html">Source</a></p> Keystone hardware wallet authenticity key stolen in website breach: Keystone's security monitoring detects unusual access to its official website; it disables sensitive site functions, blocks the access points the same day and fixes the vulnerability. https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026 https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026#2026-10-20-777c6b05 Tue, 20 Oct 2026 00:00:00 GMT high <p><a href="https://x.com/KeystoneWallet/status/2114719318722404578">Source</a></p>