TLDR Hackers who breached Keystone’s website also stole a key used to verify its hardware wallets as genuine. The stolen key could let attackers make fake wallets that pass Keystone’s authent
Hardware wallet maker Keystone said hackers who breached its website last week also stole a key used to verify that its devices are genuine. The company first described the incident as a customer data leak.
In a statement Monday, Keystone said the stolen authentication key could let attackers build fake wallets that pass its authenticity checks.
“These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” Keystone said.
Keystone said the attacker used a flaw in a third-party monitoring tool on its website to gain higher access privileges.
“This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices,” the company said.
Keystone plans to destroy 18,835 devices in its inventory that contain the compromised key. It has also paused shipments of all devices that use it.
Shipments will restart once the company begins making devices with a new authentication key.
Keystone said its Shopify store had created 51,083 buyer records. Of those, 25,119 had been deleted under its 180-day data retention policy.
The remaining 25,964 records, dating from 2024 to 2026, may have been stolen. Keystone said these older records were kept because an automated deletion tool failed.
“The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period,” Keystone said.
The attacker may also have accessed 12,873 checkout records held by Shopify. These records come from purchases that were never completed.
Keystone said it has asked Shopify to delete personal information in checkout records kept for more than 30 days.
The breach is one of several attacks on hardware wallet makers this year. Earlier this month, Ledger asked resellers in Southeast Asia and Hong Kong to stop sales. This followed reports that devices sold there had unauthorized implants that could capture recovery phrases.
In late July, Coldcard maker Coinkite warned users after attackers exploited a bug. The bug caused devices to create wallet seeds with less randomness than intended, and millions of dollars in crypto were stolen.
In August, Trezor disclosed a breach at its shipping partner. The number of affected users grew to more than 80,000 in September.
SafePal reported an order-tracking flaw in August that exposed data from nearly 40,000 customers. BitBox was targeted in a September phishing campaign tied to a compromised third-party email provider.
The Keystone incident is similar to a June 2020 Ledger breach. That leak exposed more than 1 million email addresses along with names, phone numbers and home addresses, which fueled years of phishing attempts.
Keystone said devices made and delivered before the Oct. 20 incident should be considered safe. Their authenticity checks remain trustworthy.
However, the company said it cannot guarantee devices delivered after that date. It urged affected customers to contact its support team for extra verification.
The post Fake Crypto Wallets Could Pass Checks After Keystone Hack appeared first on Blockonomi.
