Hardware wallet maker Keystone has pulled nearly 19,000 devices from its inventory and suspended unfulfilled website orders after an attacker obtained the cryptographic key used to verify whe
Hardware wallet maker Keystone has pulled nearly 19,000 devices from its inventory and suspended unfulfilled website orders after an attacker obtained the cryptographic key used to verify whether a Keystone wallet is genuine, raising the prospect that counterfeit hardware could pass the company's own authenticity check.
Keystone said on X that an attacker obtained the WebAuth key that powers its device-authentication page, the mechanism buyers use to confirm a wallet shipped directly from the manufacturer. With the key in outside hands, a sophisticated attacker could theoretically use it to make a fake device appear legitimate to anyone running the standard verification process. For related coverage, see Best Meme Coins with 50x–100x Potential in 2026.
Rather than ship stock that could no longer be reliably authenticated, Keystone said it will destroy 18,835 inventory devices carrying the old WebAuth key and will not sell or forward any unshipped website orders to customers. For related coverage, see Vanguard VSS ETF Gains Further Indirect Bitcoin Exposure.
Keystone incident 18,835 devices Inventory carrying the old WebAuth key that Keystone said it will destroy.The decision to scrap nearly 19,000 units is an unusual step for a hardware-wallet company and signals how seriously Keystone is treating the authentication gap. The company said the WebAuth key is not used for recovery-phrase generation, private-key derivation, or transaction signing, meaning wallets already in users' hands remain functionally secure for managing crypto assets. For related coverage, see Canada Draft Stablecoin Rules Cap Redemption Fees at 1%, Ban Yield.
Keystone also confirmed that devices delivered before October 20 are unaffected, according to Decrypt. The company said it has filed incident reports in the EU, the UK, and other jurisdictions, though those are company-initiated disclosures and do not represent findings or enforcement actions by any regulator.
Beyond the device-authentication issue, the incident also exposed personal information tied to Keystone's order history. Decrypt reported that 25,964 buyer records retained personal information from purchases made between 2024 and 2026.
Customer-data exposure 25,964 records Buyer records reported as retaining personal information in incident coverage.Unchained reported a broader figure: 51,083 Shopify buyer records were involved in total, though 25,119 of those had already had personal details wiped. An additional 12,873 unpaid checkout records also retained names, contact information, and shipping data. The data exposure adds a separate privacy concern on top of the device-authenticity problem, particularly given that hardware-wallet customers are often identifiable as holders of cryptocurrency.
Hardware wallets occupy a specific trust role in the crypto ecosystem: they are supposed to be tamper-evident, air-gapped devices that never expose private keys to an internet-connected computer. That promise depends partly on buyers being able to confirm they received genuine hardware, not a device that has been intercepted or swapped in transit. Incidents involving compromised hardware have surfaced before in the industry, including cases where exchange security failures led to significant losses, illustrating how hardware and custody vulnerabilities can intersect.
The WebAuth key Keystone used for its authenticity page was precisely the mechanism intended to address supply-chain risk. If an attacker holds that key, any counterfeit device they produce could generate a valid-looking verification result, giving a buyer no reliable way to distinguish a legitimate device from a fake using the standard check. Keystone's response, replacing the key and destroying old stock, is consistent with treating that verification path as compromised rather than repairable in place.
It is worth noting that no confirmed counterfeit Keystone device has been reported in public coverage of this incident. The company's disclosures describe the risk created by the stolen key rather than evidence that fake devices have already reached buyers.
For users who already own a Keystone device, the company's statement that the WebAuth key plays no role in recovery-phrase generation, private-key derivation, or transaction signing is the most relevant piece of information. Existing wallets in legitimate users' hands are not directly compromised by the authentication-key theft, and seed phrases stored correctly remain protected. However, given the nature of crypto assets, the prudent response is to follow Keystone's official channels directly for any product-specific guidance rather than act on third-party summaries.
For buyers who placed web orders that have not yet shipped, Keystone said those orders are being suspended. The company has not yet publicly detailed a replacement or reshipment timeline, so affected customers should monitor official Keystone communications for updates. Anyone considering purchasing a Keystone device from a secondary market or reseller should be especially cautious until the company releases new devices carrying a new authentication key, since old-key devices in secondary circulation cannot be verified through the previous authenticity page.
The incident is a reminder that supply-chain authentication is an active attack surface for hardware-wallet manufacturers, particularly as the value of assets managed by self-custody grows. Broader crypto-market sentiment sits at Neutral (48) on the Fear and Greed Index, and Bitcoin trades near $80,646, meaning the population of self-custody users with meaningful holdings is substantial. Security incidents like this one affect a user base where the stakes of a compromised device are directly financial. Those following hardware-security developments may also find context in reporting on other custody-related events, such as institutional Bitcoin custody decisions that reflect the broader premium placed on secure storage.
The core question for Keystone now is how quickly it can reissue devices with a new, uncompromised WebAuth key and provide buyers with a trustworthy replacement authentication path. Until that process is complete and independently verifiable, the authenticity check that the company built to protect customers against fake hardware remains unavailable.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on coinwy.com Read also :
