Keystone Hardware Wallet
@KeystoneWallet
Shopify
Security incidents tagged Shopify. Newest first.
1 Shopify incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 3 days (Oct 21–Oct 23)
- HighPartly patched
Keystone hardware wallet authenticity key stolen in website breach
An attacker who broke into hardware wallet maker Keystone's official website, detected on October 20, exploited a vulnerability in a third-party data monitoring tool to escalate privileges and stole the WebAuth key Keystone uses to verify that its devices are genuine. With that key, counterfeit wallets could pass Keystone's official authenticity check, which Keystone warns could lead to asset theft. The key is burned in at manufacture and can't be changed, so Keystone will destroy the 18,835 devices in inventory that carry it, has moved production to a new key and paused website shipping. The attacker also got 25,964 Shopify buyer records (names, contact details, shipping addresses, orders) plus 12,873 unpaid checkout records. Recovery phrases, private keys, payment details and the firmware signing key were not affected, and no counterfeit devices or thefts have been reported.
Keystone hardware wallets (device authentication key) and keyst.one storeSince Oct 20, 2026
