Hardware wallet manufacturer Keystone has announced plans to destroy nearly nineteen thousand unsold devices following a security breach. On October 20, 2026, the company discovered unauthorized access to its website, which resulted in the theft of a critical device verification key and sensitive customer shipping information. The incident has prompted immediate operational changes and an extensive asset disposal plan to protect the hardware wallet ecosystem from potential counterfeit risks.
According to published reports, the security incident originated when an attacker exploited a vulnerability in a third-party data monitoring tool. This flaw allowed the malicious actor to escalate privileges on Keystone’s official website. Consequently, the unauthorized access enabled the acquisition of customer data alongside the device verification key, forcing the hardware manufacturer to re-evaluate its data retention and security monitoring practices.
The stolen device verification key is permanently burned into hardware devices during manufacturing and cannot be overwritten or erased. However, Keystone clarified that the verification key is used exclusively for online authenticity checks via QR codes and plays no part in creating recovery phrases, deriving private keys, or signing transactions. The affected customer records involved data stored on Shopify, encompassing 25,964 buyer records from purchases made between 2024 and 2026, as well as 12,873 unpaid checkout records containing names, contact details, and shipping information.
Following the discovery, Keystone first disclosed the breach concerning customer shipping information on October 24, 2026. Further investigation revealed that an automated tool built by the company to bulk-delete shipping data after 180 days had failed reliably. In response to these findings, Keystone published a comprehensive statement detailing the theft, committing to destroy 18,835 unsold hardware devices that carry the compromised key and updating its personal data retention window from 180 days to 90 days.
While payment card details, bank information, government IDs, and purchases made through Amazon or other external sales channels remained completely unaffected, the exposure of verification keys presents unique verification challenges. Keystone has not reported any counterfeit devices or cryptocurrency thefts resulting from the incident so far. Nevertheless, the physical destruction of the unsold inventory ensures that compromised verification credentials cannot be leveraged to distribute rogue authentications for new hardware.
Customers who received their devices before October 20, 2026, and successfully pass the online authentication check can consider their hardware genuine and safe to use normally. For devices received after October 20, 2026, users are advised to contact support directly because counterfeits cannot be completely ruled out. Affected individuals should monitor direct communications from Keystone, while organizations continue to emphasise rigorous third-party tool auditing as part of broader supply chain security.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
