Keystone hardware wallet breach 2026: authenticity key stolen, 18,835 devices to be destroyed
Keystone says its wallet authenticity key was stolen
Hardware wallet maker Keystone said on 26 October 2026 that an attacker who breached its website took the key used to check that a device is genuine, as well as buyer records. It says seed phrases and private keys were not exposed and that devices delivered before 20 October are not affected if they pass authentication.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
Keystone, the maker of air-gapped hardware wallets, said on 26 October 2026 that an attacker who breached its website stole the key it uses to verify that a device is genuine. The company says it will destroy 18,835 devices in its inventory that carry that key. It says seed phrases and private keys were not exposed, and no theft of user funds has been reported.
The statement was posted on X and is quoted here as reported by The Crypto Times and Blockhead; the post itself could not be retrieved for this piece.
What Keystone says
A first disclosure on 24 October covered customer data only; the 26 October statement added the key theft. Keystone says it detected unauthorized access on 20 October and that the attacker used a flaw in a third-party data monitoring tool to gain higher privileges. The stolen item is the WebAuth key, which is written into each device during manufacturing and cannot be changed afterwards. Per the reports, Keystone says the key plays no part in generating recovery phrases, deriving private keys or signing transactions.
We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we…
The risk the company describes is counterfeit hardware. Someone holding the key could build a fake device that passes Keystone's authenticity check. Keystone has stopped using the key in production, suspended shipments of unshipped website orders and moved website sales to preorders until devices with a new key are ready.
The breach also exposed buyer data. Of 51,083 Shopify buyer records, Keystone says 25,964 still held names, contact details, shipping addresses and order information from 2024 to 2026, because an automated deletion tool failed without flagging it. A further 12,873 incomplete checkout records were exposed. Blockhead reports Keystone as saying Amazon and other sales channels were not affected.
What it changes for users
Keystone says devices delivered before 20 October were made before the incident and that owners do not need to move funds because of the breach alone. Owners who received a device with the old key after 20 October are asked to contact support for verification, even if it passes the authenticity check. Keystone's own authentication page says a device that fails verification should not be used and its seed phrase should not be entered.
The leaked addresses create a second risk: targeted scams. Keystone says it will not ask customers to return devices, and that any "recall" request, or messages about asset migration or wallet verification, should be treated as suspicious.
Background
Keystone's custody model, recovery options and past incidents are on its register entry. How hardware wallets keep keys offline is covered in What is a hardware wallet, and why the seed phrase is the thing to protect is in What is a seed phrase.
Quick answers
Were Keystone users' crypto funds stolen?
No theft of funds has been reported. Keystone says seed phrases and private keys were not exposed, and the stolen key is not used to sign transactions.
Is my Keystone wallet safe?
Keystone says devices delivered before 20 October 2026 are not affected and can be trusted if they pass its authenticity check. Owners who received a device with the old key after that date should contact Keystone support to verify it, the company says.
What data was leaked in the Keystone breach?
Keystone says 25,964 buyer records with names, contact details, shipping addresses and orders from 2024 to 2026, plus 12,873 incomplete checkout records from its Shopify store.
Sources
- Keystone, statement on X, 26 October 2026, as reported by The Crypto Times and Blockhead, retrieved 27 October 2026
- The Crypto Times, Keystone reports data breach affecting 25,964 hardware wallet buyers, 26 October 2026, retrieved 27 October 2026
- Blockhead, Keystone to destroy 18,835 hardware wallets after attacker steals device authentication key, 27 October 2026, retrieved 27 October 2026
- Keystone, device authentication page, retrieved 27 October 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.