Hardware wallet maker Keystone is destroying 18,835 finished devices from its own warehouse and has halted shipping. Behind that stands a cryptographic key. During the break-in on the company
Hardware wallet maker Keystone is destroying 18,835 finished devices from its own warehouse and has halted shipping. Behind that stands a cryptographic key. During the break-in on the company website on October 20, 2026, the so-called WebAuth key leaked, the key Keystone owners use to check online whether their device is genuine. That key is written permanently into the chip during manufacturing and cannot be swapped afterwards. The only option left to the maker is to destroy the affected batch.
For owners the picture is narrower than the number suggests. The recovery phrase is not affected, according to the company, and anyone who received their device before October 20 has nothing to return and no balance to move. The delivery date is what counts. This piece sets out what leaked, what the key can do technically, which devices are affected, and how to spot the scam wave that reliably follows reports like this.
The web shop was attacked, not an individual device. According to the company, an attacker reached the official website on October 20, 2026 through a weakness in a bought-in tool for data monitoring. Such services sit inside a company's own page as third-party code and see everything that happens there. That exact design has become the entry point several times in recent weeks, at competitors too.
Two very different things leaked, by the company's account. First, customer data: 25,964 purchase records from 2024 to 2026 with names, contact details, delivery addresses and order details, plus 12,873 abandoned checkouts. Keystone had already acknowledged that part on October 25, and we described it in our report on the confirmed data breach. Second, and this is the new part of the story, the WebAuth key.
Untouched, according to the maker, are recovery phrases, private keys, other wallet credentials, bank payment data and identity document numbers. That line matters, because it marks the difference between an annoying data leak and a loss of funds.
WebAuth key is Keystone's name for the secret with which a device proves to the maker's verification page that it came out of genuine production. The process behind it is standard in the industry and explained in two sentences: the device gets a secret burned in during manufacturing, the maker holds the counterpart to that secret, and during the check the device solves a task that only the right secret can solve. Pass the task, and it counts as genuine.
The catch lies in the word "burned in". The secret is written into the chip once and afterwards can be neither erased nor overwritten. You can change a password; a key in this form you cannot. Finished devices with the old secret therefore stay devices with the old secret permanently. Keystone has switched current production to a replacement key. For the stock already manufactured and sitting in the warehouse, that route did not exist.
A counterfeit using the stolen key would pass the online verification and would be hard to tell apart from the outside.
The consequence is unusually clear. 18,835 unsold devices with the old key are being destroyed; they will not go on sale and will not be delivered. Shipping through the website is paused, sales continue on pre-order. Anyone who wanted to order a hardware wallet from this maker in the coming days gets a delivery date instead of a parcel.
That decision costs the maker a complete batch and is the better news from a reader's point of view, because the alternative would have been shipping devices whose proof of authenticity is public. If you were facing a new purchase anyway, the criteria are in our hardware wallet comparison; since this year's incidents, the delivery route is a criterion of its own there.
Why is a verification key worth protecting at all? Because verification is the last instance before someone types a recovery phrase into a device. A tampered hardware wallet is hard to spot from the outside and shows itself above all when the maker's check fails. Whoever holds the key could, according to the company and the specialist outlets reporting on it, build replicas that pass that check.
What is established is a possibility, not an incident. So far there is no report of counterfeits actually surfacing with the stolen key, and no report of funds lost through one. That is why the maker says explicitly that nobody has to move funds on account of this incident alone. The risk sits with future stock from unclear sources, hardly with the devices already in customers' hands.
How real that pattern is was shown by the Ledger case this year: devices carrying an extra chip circulated through resellers in Southeast Asia, and the damage ran to more than $86 million by analyst estimates we reported on October 9, 2026. The difference from today's case: at Ledger the distribution route was attackable, at Keystone the proof itself.
A recovery phrase, usually called a seed phrase, is the list of twelve or twenty-four words from which all of a wallet's keys can be derived again. That list is created on the device and never leaves it in normal use. That is precisely why a break-in at a web shop does not touch it: what sits there are orders, not keys.
This separation is the real value of self-custody, and in this case it holds. If you store your recovery phrase properly, you have nothing to do after this incident. If you are unsure whether your own storage holds up, the common mistakes are in our guide to storing a seed phrase safely.
Keystone is asking for no devices back: any supposed return request is an attempted scam.
The maker draws the line at the day of the break-in. Devices delivered before October 20, 2026 remain safe to use, according to the company, provided they pass verification. That covers the large majority of devices in circulation, because the key only became known with the break-in.
The case is different for devices shipped after October 20 with the old key. Those customers should contact support and have an additional check carried out before using the device, the maker says. A second look at the shipping confirmation in your inbox therefore settles which of the two groups you are in.
Regardless of that, the handling of a new device stays the same: never set up a second-hand device or one from an unfamiliar dealer with an enclosed recovery phrase, and a device that wants to confirm a payment without a clear display deserves suspicion.
Here lies the bigger everyday risk of this incident, and it has nothing to do with technology. A report about destroyed devices is the perfect template for a scam: a letter in the maker's name, a supposed recall, an exchange programme, a "security migration". The leaked delivery addresses fit that neatly, because a message carrying your name and address sounds credible.
Keystone makes two things clear on this. The company asks nobody to send in a device, and anyone requesting that is a fraudster, in the maker's words. In its statement of October 26, 2026, titled "Statement Regarding the Security Incident on Our Official Website and Customer Guidance", the company also admits a failing on customer data through its @KeystoneWallet account: it did not keep its commitment to delete customer data on time and takes responsibility for that. An automatic deletion tool had failed without anyone noticing; the retention period now drops from 180 to 90 days.
Remember the simple rule: nobody who means well needs your hardware device or your twelve words. Any message demanding either can be deleted without further checking.
The data side of the incident lasts longer than the key side. A delivery address is not changed like a password, and the combination of name, address and the information "owns a hardware wallet" is valuable to criminals. That ranges from targeted phishing emails to the rare but documented case of physical coercion.
In practice: expect post and emails in the coming months that spell your name correctly. That correctness proves nothing; it is a consequence of the leak. If you order again, choose a delivery route that keeps your home address out of the next database.
Partly, and that honest answer is more useful than a reassuring formula. For new devices from the switched production line, what applied before applies again: a key known only to the maker and the device. For devices with the old key already in customers' hands, the online check can still confirm a genuine device, but it can no longer reliably rule out a replica built with the stolen key.
That weakness only runs out once the old batch has disappeared from the market, and that takes years. Until then the purchase route carries more weight than the verification tick: a device straight from the maker or an authorised dealer, sealed, with no words enclosed.
The Keystone case does not stand alone, but it repeats none of the earlier ones either. Set this year's incidents side by side and each hit a different point between manufacturing and user, and that is where the real lesson lies:
Two makers within two days, and in both cases an automatic deletion of old customer data failed. That connects the cases more strongly than the technology does: the weak point was not the device but the company around it. The hardware wallet itself delivered what it promises in all four cases, because the private keys stayed inside the device. Anyone drawing a conclusion from that draws it at the data trail of the purchase and at the delivery route, not at the choice of chip.
The number 18,835 describes a batch in the warehouse, not the devices in customers' drawers. The maker drew that distinction itself, and it is the core of the report. Further detail is in the coverage by The Hacker News.
(As of October 28, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
