Timeline
- 8.0
Keystone Breach Exposed 25,964 Purchase Records and Compromised Device Verificat
Keystone said its investigation found that attackers who breached its website obtained the WebAuth device-authentication key used to verify that a hardware wallet is genuine, potentially allowing counterfeit devices to pass official authenticity checks. The company will destroy 18,835 unsold devices built with the old key, pause unshipped orders and move new production to a replacement key, while the incident affected 25,964 purchase records and 12,873 incomplete checkout records. The compromised key undermines the authenticity check customers rely on to confirm a device is genuine, even though Keystone said seed phrases, private keys and transaction signing were not compromised. The exposed purchase data — names, contact details, shipping addresses and order details — creates phishing risk, and one customer had already reported a social-engineering call that used Keystone order information. Keystone said the affected records were limited to purchases made through Shopify on its official site, and that its automated data-deletion tool "did not operate reliably," so some personal information was retained beyond the promised period; it also said another roughly 25,000 records had already been permanently erased under its retention policy.
- 7.0
Keystone customers say breach exposed data the hardware wallet maker promised to delete
Customers of hardware wallet maker Keystone say a data breach exposed personal information that the company had previously pledged to delete, according to a report by The Block published on Oct. 25, 2026. The accounts describe a leak of customer records rather than of wallet keys or on-device funds. The exposure creates phishing and physical-security risk for self-custody users, whose contact and delivery information can be used to target them directly, according to the report. It also undercuts a data-retention promise made by a vendor whose product is built around user-controlled security. The complaint centers on data that customers say Keystone had told them would be erased, and the reported material relates to customer contact and shipping details rather than the air-gapped signing devices themselves.