# Keystone hardware wallet authenticity key stolen in website breach · pwn.watch > An attacker who broke into hardware wallet maker Keystone's official website, detected on October 20, exploited a vulnerability in a third-party data monitoring tool to escalate privileges and stole the WebAuth key Keystone uses to verify that its devices are genuine. With that key, counterfeit wallets could pass Keystone's official authenticity check, which Keystone warns could lead to asset theft. The key is burned in at manufacture and can't be changed, so Keystone will destroy the 18,835 devices in inventory that carry it, has moved production to a new key and paused website shipping. The attacker also got 25,964 Shopify buyer records (names, contact details, shipping addresses, orders) plus 12,873 unpaid checkout records. Recovery phrases, private keys, payment details and the firmware signing key were not affected, and no counterfeit devices or thefts have been reported. Page: https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026 · generated 2026-10-27T15:36:50.234Z ## Status - Severity: high · status: live · patch: partial - Product: Keystone hardware wallets (device authentication key) and keyst.one store - Started: 2026-10-20 - Affected: Keystone hardware wallets received after October 20, 2026 that carry the old device authentication (WebAuth) key; 25,964 buyer records from Keystone's official Shopify store (2024 to 2026) and 12,873 unpaid checkout records - Fixed in: Newly manufactured Keystone devices with a new authentication key ## Follow this incident - RSS (one item per update): https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026.json - This file: https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026/llms.txt ## Updates (newest first) - 2026-10-26: Keystone's full statement: the attacker exploited a vulnerability in a third-party data monitoring tool on the website to escalate privileges and also stole the WebAuth key used to verify that devices are genuine. 25,964 Shopify buyer records (2024 to 2026) and 12,873 unpaid checkout records were exposed. The 18,835 devices in inventory with the old key will be destroyed, new devices get a new key, and website shipping is paused. (https://x.com/KeystoneWallet/status/2114719318722404578) - 2026-10-24: Keystone first discloses the breach as a leak of customers' shipping information and asks Shopify to erase buyer data past its retention period. (https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html) - 2026-10-20: Keystone's security monitoring detects unusual access to its official website; it disables sensitive site functions, blocks the access points the same day and fixes the vulnerability. (https://x.com/KeystoneWallet/status/2114719318722404578) ## Fix brief # Security brief: Keystone hardware wallet authenticity key stolen in website breach Source: https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026 · status: live · severity: high · updated Oct 27, 2026, 13:03 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is An attacker who broke into hardware wallet maker Keystone's official website, detected on October 20, exploited a vulnerability in a third-party data monitoring tool to escalate privileges and stole the WebAuth key Keystone uses to verify that its devices are genuine. With that key, counterfeit wallets could pass Keystone's official authenticity check, which Keystone warns could lead to asset theft. The key is burned in at manufacture and can't be changed, so Keystone will destroy the 18,835 devices in inventory that carry it, has moved production to a new key and paused website shipping. The attacker also got 25,964 Shopify buyer records (names, contact details, shipping addresses, orders) plus 12,873 unpaid checkout records. Recovery phrases, private keys, payment details and the firmware signing key were not affected, and no counterfeit devices or thefts have been reported. Severity detail: Device authenticity key stolen, so counterfeit wallets could pass the official check; 25,964 buyer addresses exposed - Product: Keystone hardware wallets (device authentication key) and keyst.one store ## Affected versions - Keystone hardware wallets received after October 20, 2026 that carry the old device authentication (WebAuth) key - 25,964 buyer records from Keystone's official Shopify store (2024 to 2026) and 12,873 unpaid checkout records ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Newly manufactured Keystone devices with a new authentication key After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you own a Keystone: a device delivered before October 20, 2026 that passes the check at keyst.one/authentication can be used normally. If you received one after October 20 with the old key, don't use it until Keystone support (support@keyst.one) confirms it's genuine. You don't need to move funds because of this. Keystone won't ask you to return a device; treat any recall, refund, replacement or 'wallet verification' call, text, email or letter as a scam, and never enter a recovery phrase into a device you didn't order. ## Latest updates - Oct 26, 2026: Keystone's full statement: the attacker exploited a vulnerability in a third-party data monitoring tool on the website to escalate privileges and also stole the WebAuth key used to verify that devices are genuine. 25,964 Shopify buyer records (2024 to 2026) and 12,873 unpaid checkout records were exposed. The 18,835 devices in inventory with the old key will be destroyed, new devices get a new key, and website shipping is paused. - Oct 24, 2026: Keystone first discloses the breach as a leak of customers' shipping information and asks Shopify to erase buyer data past its retention period. - Oct 20, 2026: Keystone's security monitoring detects unusual access to its official website; it disables sensitive site functions, blocks the access points the same day and fixes the vulnerability. ## Advisories - [Statement Regarding the Security Incident on Our Official Website and Customer Guidance](https://x.com/KeystoneWallet/status/2114719318722404578) (Keystone) ## Write-ups & news - [Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key](https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html) - [Keystone breach deepens: Hackers stole key used to verify wallets as genuine](https://cointelegraph.com/news/keystone-breach-deepens-hackers-stole-key-used-to-verify-wallets-as-genuine) ## Caveats Keystone says the WebAuth key is used only for the authenticity check, not for seed generation, key derivation or signing, and that its firmware signing key is separate and was not affected. Overdue buyer data is due to be erased by Shopify on November 3, 2026; Keystone is cutting retention from 180 to 90 days and has reported the incident in the EU, UK and other jurisdictions. It hasn't named the monitoring tool or said when the attacker first got in. --- Machine-readable: https://pwn.watch/i/keystone-hardware-wallet-auth-key-stolen-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.