bitcoin ·
Keystone pulls devices after stolen factory key affects 25,964 buyer records
Keystone, a manufacturer of Bitcoin hardware wallets, is recalling devices after an attacker acquired the factory key used to verify their authenticity.
This security lapse impacted 25,964 buyer records from Keystone's Shopify store, covering the period from 2024 through 2026. The company confirmed that recovery phrases and private keys were not compromised in the incident.
Keystone announced it will destroy 18,835 unsold hardware wallets and has halted shipping on all unshipped orders. The risk involves counterfeit wallets that appear genuine because the attacker obtained the verification key.
"If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks," Keystone stated in its official communication. "These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft."
The exploited key is described as a WebAuth key, which is a non-erasable, non-rewritable secret code embedded in each device during factory production.
The breach, first detected on October 20, involved customer shipping information, and the subsequent Monday statement detailed the stolen key and the 25,964 affected records.
Keystone admitted a failure in its data management, noting that its automated bulk-deletion tool did not reliably erase all buyer records after the 180-day retention period. The company accepted responsibility for this oversight.
This incident follows prior data exposure events in the industry; for example, Ledger experienced a leak reaching approximately 292,000 customers in 2020.
The broader industry context highlights that customer lists remain a persistent vulnerability for wallet producers, as such data can lead to risks like "wrench attacks," where criminals use coercion to steal crypto assets.
Why it matters
This incident highlights the critical security risks associated with hardware wallet manufacturing and supply chain integrity. For DeFi participants, the potential for counterfeit, yet seemingly genuine, devices introduces a new vector for asset theft that requires heightened awareness regarding device provenance.
