Keystone destroys 18,835 devices after website breach exposes buyer records and authentication key

This action follows a website security breach that exposed customer information and a critical key.

The vulnerability allowed an attacker to gain access to the company’s website on October 20 via a flaw within a third-party data monitoring tool, Keystone stated on Monday. This intrusion revealed 25,964 records belonging to buyers spanning from 2024 through 2026.

The exposed buyer data included names, contact particulars, shipping addresses, and order details. Additionally, an estimated 12,873 unpaid checkout records might have been impacted by the exploit.

The compromised key is integrated into devices during the production process and is immutable. This key enables wallets to successfully pass online authenticity verification, creating a risk that counterfeit hardware could appear genuine to users.

The firm confirmed that the breach did not expose private keys, recovery phrases, or wallet credentials. However, Keystone admitted that an automated deletion mechanism failed without detection, meaning some customer data should have been removed under its 180-day policy.

Keystone stated, “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.”

This incident contributes to a pattern of security compromises affecting hardware wallet users this year. Other entities have faced similar issues, including incidents at Ledger involving hidden components capturing recovery phrases and flaws in Coldcard's seed-generation software allowing remote private key reconstruction.

In response, Keystone will replace the authentication key in newly manufactured devices and transition website sales to a preorder model. Furthermore, the company will reduce its customer data retention period to 90 days.

The wider industry trend shows that protocol-level security surrounding hardware and L2 infrastructure remains a critical concern for market participants and institutions. The failure to manage data lifecycle and the exposure of device-level secrets highlight ongoing vulnerabilities in decentralized finance tooling.

Why it matters

This incident highlights the persistent security risks across the hardware wallet ecosystem, which is foundational infrastructure for DeFi users. Failures in data retention and supply chain integrity, like the exposed authenticity key, directly threaten user asset security. Readers should monitor how wallet manufacturers respond to these systemic vulnerabilities.