Keystone will destroy 18,835 unsold hardware wallets after attackers obtained a device-authentication key that could help counterfeit devices pass verification. The breach exposed 25,964 purc
Hardware wallet manufacturer Keystone will destroy 18,835 unsold devices after discovering that attackers obtained a cryptographic credential used to verify whether its products are genuine.
The finding, disclosed in the company’s October 26 security update, substantially expands the consequences of a website intrusion first detected on October 20.
Alongside the authentication credential, attackers obtained personal information from 25,964 purchase records and 12,873 incomplete checkouts. Keystone says the incident did not compromise recovery phrases, private keys or transaction-signing functions.
The central security concern is no longer limited to customer privacy. A counterfeit hardware wallet could potentially pass a verification process that buyers use to establish trust before transferring cryptocurrency.
The compromised credential, identified as a WebAuth device-authentication key, is embedded into Keystone hardware wallets during manufacturing.
Its purpose is to support a cryptographic authenticity check. Keystone’s official verification tool asks users to scan a QR code, enter a code displayed on their device and check the resulting verification response.
Possession of the compromised credential could allow an attacker to reproduce a valid authentication response on counterfeit hardware. The precise feasibility depends on how the attacker implements the credential and the verification protocol.
This is distinct from stealing a wallet’s private keys. The WebAuth credential is not used to generate recovery phrases or authorize cryptocurrency transactions.
However, the distinction offers limited reassurance to someone purchasing a malicious replacement device. If counterfeit hardware successfully impersonates an authentic wallet, the attacker may be able to target the user’s recovery phrase or manipulate the device’s behavior during setup.
Keystone says the authentication credential cannot be erased or rewritten once embedded. Consequently, the company will destroy its remaining inventory containing the old key rather than distribute devices whose authenticity checks can no longer provide the intended assurance.
Manufacturing will switch to a replacement credential, while unshipped orders are suspended. New purchases will remain on a preorder basis until replacement inventory becomes available.
The decision also creates a practical test for Keystone’s supply-chain controls: the replacement key must be protected throughout manufacturing, distribution and verification, not merely generated securely.
Keystone’s investigation identified 51,083 purchase records in its Shopify-based store. Personal information had already been deleted from 25,119 of them, leaving 25,964 records containing customer details.
Another 12,873 incomplete checkout records were affected.
The exposed information included names, contact details, shipping addresses and order histories. The two affected record categories total 38,837, although some individuals may appear in both.
Keystone attributed the initial website intrusion to a vulnerability involving a third-party data-monitoring tool. The company says it disabled sensitive website functions and blocked unauthorized access after detecting the incident.
The investigation also identified failures in its data-deletion procedures.
Keystone had previously promoted a policy of deleting shipping information after 180 days. However, some older records remained accessible because automated deletion requests had not been completed as intended.
Customers had already questioned the policy after receiving breach notifications for purchases made more than six months earlier.
Keystone says it has shortened its retention period to 90 days and submitted requests to Shopify to remove overdue purchase information. Those deletions are expected to complete by November 3, subject to Shopify’s processing requirements.
The exposure creates a particularly sensitive phishing risk. Criminals with accurate order histories and delivery addresses can impersonate a wallet manufacturer more convincingly than attackers relying on generic messages.
A fraudulent replacement offer referencing a genuine purchase could be used to direct a customer toward a counterfeit device or a website requesting their recovery phrase.
Keystone has distinguished between devices delivered before and after October 20, the date it detected the intrusion.
The company’s guidance does not require every existing owner to replace their wallet or move cryptocurrency. It does, however, make the delivery date and device-authentication status important.
Customers can access the official Keystone verification page, but a successful result alone may be insufficient for recently delivered devices using the compromised credential.
Keystone has also warned that attackers may impersonate its staff through email, telephone calls, text messages or physical mail. Users should independently navigate to the company’s website rather than follow links in unexpected notifications.
The company plans to introduce tools allowing customers to check whether their personal information was exposed and whether deletion requests have been completed.
For existing owners, the website intrusion does not establish that their cryptocurrency has been stolen or that recovery phrases must be replaced. The more immediate risks concern counterfeit-device distribution and targeted social engineering.
Keystone’s inventory destruction addresses the first problem. Restoring confidence in its authentication process will depend on the security of the replacement credential and the controls governing its future use.
The post Why Keystone is Scrapping 18,835 Wallets (And What Existing Owners Should Do) appeared first on ETHNews.
