Keystone, a maker of crypto hardware wallets, said an attacker who broke into its website stole the key its devices use to prove they are genuine. Someone holding that key could build counterfeit wallets that pass the online authenticity check owners rely on, and a buyer who trusted a counterfeit could have their crypto stolen. Keystone said the incident did not involve owners’ recovery phrases or wallet private keys, and it has not reported any counterfeit devices or thefts. It will destroy 18,835 unsold devices that carry the key, and all new devices will get a new one.
Keystone found the unauthorized access on October 20. According to the company, the attacker exploited a vulnerability in a third-party data monitoring tool used by its website to escalate privileges, then obtained customer data and the key. Keystone says it has blocked the access and fixed the vulnerability. The key is written into each device during manufacturing and cannot be rewritten, so devices already made cannot be switched to a new one. Separately, Keystone said 25,964 buyer records from website purchases between 2024 and 2026 were affected (names, contact details, shipping addresses, and order details; no payment card, bank, or government ID data), plus 12,873 unpaid checkout records. Some of that data should already have been deleted under the company’s 180-day retention promise, but an automated deletion tool failed without being noticed. Keystone is cutting retention to 90 days.
How to check if you’re affected
Affected devices are Keystone hardware wallets, and Keystone’s guidance depends on when your device arrived, not where you bought it:
- Delivered before October 20: if it passes Keystone’s verification check, the company says it can be considered genuine and used normally.
- Received after October 20 with the old key: Keystone says it cannot rule out that the device is counterfeit even if it passes the check. Do not use it until Keystone support (support@keyst.one) confirms it is genuine.
- Bought through Amazon or a reseller: the same guidance applies.
- Waiting on a website order: shipping is paused until devices with the new key are ready.
Keystone told owners to follow instructions on its device verification page, but The Hacker News reported the page showed none as of October 27, and Keystone has not said how to tell which key a device carries. Treat any call, text, email, or letter offering a refund, replacement, recall, or help moving crypto as a scam; Keystone says it will not ask anyone to return a device. Never enter a recovery phrase into a device you did not order, and type keyst.one into your browser rather than following links. If your data was in the affected purchase records, Keystone says it is emailing affected customers.