Keystone Hardware Wallet Breach: Hackers Stole Its Verification Key, 18,835 Devices to Be Destroyed

Hardware wallet maker Keystone has admitted its website breach is worse than first thought. On October 26, the company said attackers stole the key it uses to verify that Keystone wallets are genuine, and it will destroy 18,835 devices in stock. Your recovery phrase and private keys are not affected, but if you own a Keystone or were about to buy one, here's what happened and what to do.

Last updated October 27, 2026. This is a developing story.

What happened, day by day

• October 20: Keystone detected unauthorized access to its website.
• October 24: Keystone first disclosed the incident on X as a customer data leak: names, contact details, shipping addresses and order records were exposed.
• October 26: Keystone revealed the bigger problem. The attacker had also obtained its WebAuth key, and the company said it will destroy 18,835 devices carrying that key.

Keystone traced the intrusion to a flaw in a third-party monitoring tool on its website, which the attacker used to gain higher access. According to reports, the leak involved about 25,964 purchase records and 12,873 incomplete checkouts.

Why the stolen key matters

The WebAuth key is written into Keystone wallets at the factory and is used when you check your device on Keystone's official verification website. It can't be changed after a device is made. In theory, someone holding it could build counterfeit wallets that pass the official "is it genuine?" check. That's why Keystone is scrapping the affected stock and has switched new production to a different key. Pending orders are on hold until replacement devices are ready.

What was NOT affected

Keystone says recovery phrases, private keys and wallet passwords were not exposed, and payment card and bank details weren't either. The funds on a genuine Keystone you set up yourself aren't at risk from this breach alone.

What Keystone owners should do

• Verified your device before October 20? Keystone says those devices are considered safe.
• Received a device with the old key after October 20? Even if it passed verification, Keystone asks you to contact its customer service for further checks. You don't need to send the device back.
• Watch out for scams. Leaked names and home addresses are exactly what phishers use. Keystone warned that scammers may pretend to be its staff offering refunds or replacement devices. Never type your recovery phrase into any website, app, email or form, for any reason.

My take

This is a nasty one, and not because anyone's coins were stolen. A hardware wallet is all about trust: you buy it so you don't have to trust anything online. A stolen verification key and leaked home addresses hit exactly that trust. Credit to Keystone for destroying the stock instead of quietly selling it, but the slow drip of bad news, a data leak on the 24th and a stolen key on the 26th, won't help. If you hold crypto, the lesson is the same as always: your recovery phrase never leaves paper or metal, and nobody legit will ever ask for it. Are you sticking with your Keystone?