Keystone to Destroy 18,835 Hardware Wallets After WebAuth Key Theft

WebAuth Key Theft Forces Inventory Destruction

Keystone will destroy 18,835 unshipped hardware wallets after an attacker stole the cryptographic key the company uses to certify its devices as genuine. In a post-mortem published on Monday, October 26, the manufacturer explained that the stolen WebAuth key is embedded permanently during production and cannot be rewritten or erased, so a device built with it could be counterfeited and still pass Keystone's authenticity check. That check exists to stop forged units from reaching buyers, which is what makes the loss of a manufacturing-level key so damaging: a counterfeit could load funds into a crypto wallet the attacker effectively controls, while passing every vendor test, and revocation is impossible for units already built. The company's investigation traces the intrusion to a vulnerability in a third-party data monitoring tool that let the attacker escalate access on the official website. Suspicious activity was detected on October 20; the affected website functions were disabled and a forensic review began, and the firm confirmed on October 23 that a third party had obtained customer shipping information. Shipping of open web orders is suspended, the store has switched to a presale model, and Keystone has not said when replacement production built with a new key will finish. In the update, the company states that recovery phrases, private keys, wallet credentials and payment information were not exposed, that devices delivered before October 20 remain safe to use if they pass authenticity verification, and that units received afterward need extra checks through customer support. Keystone has filed regulatory reports in the European Union, the United Kingdom and other jurisdictions, plans a data-breach lookup tool, has not asked customers to move their funds solely because of the incident, and warns buyers to ignore fraudulent recall messages asking them to send devices back.

@KeystoneWallet · X post

The update.

View on X

25,964 Buyer Records Held Past Deletion Date

The same investigation exposed a failure in how Keystone managed customer data. Of 51,083 Shopify buyer records reviewed, 25,964 still contained personal information, including names, shipping addresses, contact details and purchase history spanning 2024 to 2026. The company acknowledged that its automated deletion system had malfunctioned, leaving information stored beyond the 180-day retention window it had promised customers. “We failed to fulfill our commitment to delete customer data on time, and we take responsibility,” the firm stated. Another 25,000 records had already been permanently erased under the retention policy, but the gap shows the deletion tooling did not operate reliably. Investigators also identified 12,873 unpaid checkout records holding potentially sensitive details, now added to the deletion queue. Retention is capped at 90 days going forward, and overdue deletion requests submitted on October 24 are expected to complete by November 3. The breach surfaced after a customer described a “social engineering” phone call in which Keystone order information was used, and the manufacturer confirmed the shipping-data theft in an apology posted on Saturday, October 24, roughly 18 hours after that report. Keystone is not the only vendor under strain. Phishing emails began reaching Foundation Passport users early on Monday, sent from Foundation's own domain after one or more API keys on Cloudflare were compromised. The company counts more than 20,000 phishing attempts delivered across its systems and is still determining how many users had personal data exposed. The emails leaned on scare tactics about a display module, echoing recent compromised Ledger devices. Foundation attributes the exposure to botched database migrations, in which older order tables were never redacted, says Shopify orders placed more recently may also have been affected, and had previously assured customers their data would be purged automatically within 60 days.

@KeystoneWallet · X post

An apology.

View on X

The common thread is that neither incident broke the devices themselves; both failed at the operational layer, in web infrastructure, retention hygiene and database migrations. That shifts the practical risk toward phishing. Leaked names, addresses and order histories make fraudulent calls and emails convincing, and the recent Ledger spyware episode and Coldcard seed-generation bug together produced more than $200 million in losses through similar social-engineering plays. Keystone's confirmation that recovery phrases were untouched is the most reassuring fact here, since a leaked recovery phrase would compromise every address an HD wallet derives. For anyone holding a cold wallet, verification should run only through official channels, and any recall or refund message deserves suspicion until confirmed. The episode is also a reminder that much of the real damage traces to common hardware wallet errors and vendor-side lapses rather than broken hardware.