Keystone to destroy 18,835 unsold hardware wallets after website breach exposes customer data and key

Keystone, a maker of crypto hardware wallets, has announced that it will destroy 18,835 unsold devices and suspend shipments following a security breach on its website. The company disclosed the incident on Monday in a post on X.

According to Keystone, an attacker got into its website on Oct. 20 by exploiting a flaw in a third-party data monitoring tool. The intrusion exposed 25,964 buyer records covering 2024 through 2026, including names, contact details, shipping addresses and order information. A further 12,873 unpaid checkout records may also have been affected.

The most serious consequence involves a key that was taken during the attack. It is written into each device during production and cannot be altered. The key lets a wallet pass online authenticity checks, so counterfeit devices could appear genuine and endanger users' funds. Keystone said the breach did not expose recovery phrases, private keys or wallet credentials.

The company also admitted a data-handling failure. Some customer records should have been erased under its 180-day retention policy, but an automated deletion tool broke without the firm noticing. Keystone wrote that it failed to meet its commitment to delete customer data on time and accepts responsibility.

Keystone said devices delivered before Oct. 20 remain safe to use as long as they pass authentication. Customers who received devices using the old key after that date should seek further checks before use. Users do not need to move funds because of the breach alone, and the company warned them to be wary of fake recall or asset migration messages. Going forward, it will replace the authentication key in new devices, move website sales to preorders and shorten customer data retention to 90 days.

The update came a day after another hardware wallet maker, Foundation, disclosed a separate breach in which attackers sent phishing emails that appeared to come from its official domains. Foundation counted more than 23,000 phishing attempts and found no evidence that Passport devices or private keys were compromised. It also found older database copies missed by its 60-day deletion process, containing about 5,600 mailing addresses and 5,200 phone numbers, though it could not confirm how many were accessed.

The incidents follow other attacks on hardware wallet users this year, including tampered Ledger devices sold through resellers in Southeast Asia and a seed-generation flaw in Coldcard software that allowed remote key reconstruction.