Keystone plans to destroy 18,835 unsold hardware wallets after an attacker stole a key used to verify whether its devices are genuine. The company disclosed the expanded scope of its website breach on October 26, raising concerns that counterfeit wallets could pass its authenticity checks.
The stolen key was used for device verification. According to Keystone, the incident did not expose users’ recovery phrases or wallet private keys.
Key Takeaways
- Keystone will replace its compromised verification key in newly manufactured devices.
- Customers who received devices after October 20 face additional verification requirements.
- The breach also exposed customer information, creating opportunities for targeted scams.
Why the Stolen Key Matters
A hardware wallet’s authenticity check helps buyers establish whether a device came from its manufacturer. If an attacker can reproduce the correct response, that check becomes less reliable.
As The Hacker News reported, Keystone’s compromised key cannot be replaced in devices already manufactured. This explains the decision to destroy the affected inventory.
Device authentication and a user’s private key serve different purposes: one verifies hardware, while the other authorises access to crypto assets. A compromised authenticity check creates a potential route for malicious replacement devices without directly revealing an existing wallet’s signing keys.
Keystone had not reported counterfeit devices or associated crypto theft when the October 27 report was published.
Customer Data Adds Another Risk
Blockhead’s reporting also described the exposure of nearly 26,000 buyers’ personal information. Some records remained available after an automated deletion tool failed.
Personal information can make a fraudulent support message more convincing. A message containing a buyer’s name or order details can still be an attempt at social engineering.
Customers should reach support independently and avoid sharing recovery phrases in response to unsolicited messages.
What Owners Should Check
Keystone says devices delivered before October 20 can be used normally if they pass authentication. Devices received after that date carrying the old key should remain unused until official support confirms their authenticity.
The company has not disclosed when the attacker first gained access. Owners should therefore treat the delivery-date guidance as Keystone’s assessment of the incident.
Broader crypto wallet security practices remain relevant: protect recovery backups, verify support channels and carefully check any request involving wallet access.
Conclusion
Keystone’s response addresses a weakness in device verification alongside a separate customer-data exposure. For owners, the immediate priority is to follow the company’s delivery-date guidance and verify communications before taking action involving their wallet.
