Hardware wallet maker Keystone has disclosed that hackers who breached its website also stole a key used to verify whether devices are genuine, expanding an incident that was initially believ
Hardware wallet maker Keystone has disclosed that hackers who breached its website also stole a key used to verify whether devices are genuine, expanding an incident that was initially believed to involve customer data only.
The disclosure raises a more serious security concern: counterfeit hardware wallets could potentially pass Keystone’s authenticity checks and appear legitimate to users.
Keystone initially disclosed that attackers had accessed customer information including names, contact details, addresses and order information.
The company later confirmed that the breach also exposed an authentication key used by its verification system.
According to Keystone, an attacker could potentially use the stolen key to create counterfeit devices that successfully pass authenticity checks.
A user purchasing one of those devices could therefore believe the wallet is genuine even when it has been modified or replaced.
Hardware wallets are designed to keep private keys away from internet-connected devices.
But that protection depends on the hardware itself being trustworthy.
A compromised or counterfeit device could potentially capture a recovery phrase or private key during setup and later allow an attacker to access the wallet.
That makes supply-chain security increasingly important.
Users need to consider not only how they store their recovery phrase, but also where the device was purchased and whether its hardware and firmware can be trusted.
Keystone is not the only hardware wallet company to face security problems in 2026.
Earlier in October, Ledger asked some resellers in Southeast Asia and Hong Kong to suspend sales following reports of devices containing unauthorized hardware implants capable of capturing recovery phrases.
Coldcard also investigated a phishing link that appeared on its official X account earlier this month and warned users not to interact with it.
Separately, NGRAVE users were targeted through compromised wallet notifications in a phishing campaign linked to approximately $2.65 million in losses.
Together, the incidents show that attackers are increasingly targeting the infrastructure surrounding hardware wallets rather than attempting to break the cryptography directly.
Recovery after a crypto exploit remains difficult.
A Blockaid analysis of 60 major onchain exploits from January through August 2026 found that attackers controlled approximately $1.18 billion in stolen assets.
The median time before stolen funds were moved was just 17 minutes.
In 68% of incidents, funds moved within one hour, while 22% moved within the first minute.
Only $9.8 million had been returned to victims by the report’s cutoff date.
That speed leaves exchanges, security firms and blockchain investigators very little time to react.
The Keystone incident reinforces several basic security practices.
Buy directly from trusted sources. Avoid second-hand hardware wallets or devices from unknown marketplace sellers.
Never use a recovery phrase supplied with a device. A legitimate wallet should generate a new phrase during setup.
Verify firmware updates independently. Use the manufacturer’s official website rather than links received through email, social media or messages.
Be suspicious of replacement offers. Data breaches can allow attackers to target known hardware wallet customers with highly convincing phishing campaigns.
Move funds if a device may be compromised. Generate a new wallet using trusted hardware and transfer assets rather than continuing to use potentially exposed keys.
Hardware wallets remain one of the strongest ways to separate crypto private keys from internet-connected devices.
But recent attacks demonstrate that security no longer ends with keeping a seed phrase offline.
Manufacturers, distributors, websites, authentication systems and customer databases can all become attack surfaces.
The Keystone breach is therefore significant not because hardware wallets have suddenly stopped being useful, but because attackers are becoming better at targeting the trust systems surrounding them.
For crypto holders, verifying where a device came from may now be nearly as important as protecting the recovery phrase stored inside it.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
