The short version
- Keystone wallet maker Keystone says a website breach on October 20 exposed the names, addresses and orders of 25,964 buyers, plus the key that proves a device is genuine.
- The key can’t be changed on wallets already built, so Keystone will destroy 18,835 devices in stock and has paused shipping; seed phrases, private keys and funds were not touched.
- The crew is watching for fake Keystone devices and “recall” scams aimed at buyers whose home addresses are now out there.
A hardware wallet is meant to be the boring, safe part of crypto. This week Keystone wallet buyers found out the shop can be the weak spot. The maker says an attacker got into its official website on October 20 and took names, contact details, home addresses and orders for 25,964 buyers.
Worse, the attacker also took the key Keystone uses to prove a device is genuine. Keystone’s answer is to destroy all 18,835 wallets in its warehouse. So is your Keystone wallet still safe, and what should owners do now?
Keystone owned up on Saturday, in a post that opened with an apology:
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we
What Happened in the Keystone Wallet Breach?
The attacker used a flaw in a third-party data monitoring tool on the website to gain higher access, Keystone said in its full statement on Monday. The data sat in its Shopify store: 51,083 buyer records in all, plus 12,873 checkouts where nobody paid but people had typed in a name and shipping address.
About half the old orders had already been wiped. The other 25,964 records, from 2024 to 2026, still held personal data, although Keystone had promised to erase it after 180 days. Its bulk-erasure tool failed quietly and nobody noticed. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company wrote.
Amazon orders and other sales channels were not affected. Card and bank details, ID numbers, recovery phrases and private keys were not involved. Keystone now keeps customer data for 90 days and expects Shopify to finish erasing the overdue records on November 3.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why Is Keystone Destroying 18,835 Devices?
Because the stolen key is built into every wallet at the factory. It powers Keystone’s device authentication page, the check that tells you a device is the real thing, and it cannot be erased or rewritten.
With that key, an attacker could build fake wallets that pass the check. A counterfeit hardware wallet is the perfect trap: you type your seed phrase into it and the thief has your coins.
The key plays no part in creating seed phrases, deriving private keys or signing transactions, so wallets already in use keep working. Stock carrying the old key can’t be trusted, though. Production has switched to a new key, the 18,835 units on the shelf will be destroyed, shipping of open orders is paused, and sales run as preorders until new devices are ready.
SIDE TRAIL: Crypto Hacks in October: $129M Lost, DeFi’s Quietest Month
Is My Keystone Wallet Safe?
Yes, if your Keystone wallet arrived before October 20 and passes the authentication check. Keystone says those devices are genuine and there’s no need to move your funds because of this breach.
Got one after October 20 that still carries the old key? Even a pass doesn’t settle it: Keystone says it “cannot completely rule out the possibility that it is counterfeit.” Contact support through the authentication page and wait for the all-clear before you load a seed. Keystone will not ask you to send a device back, so any “recall” is a scam.
The Real Risk Is Your Home Address
Your coins are safe. You might be a different story. A list of names and home addresses of people who bought a hardware wallet is a list of crypto holders, and it’s now in someone else’s hands.
Crypto has seen a hardware wallet breach like this before. In December 2020, more than 270,000 Ledger customers’ names and addresses were dumped online. Buyers got phishing emails and letters, and in 2021 fake “replacement” Ledgers arrived by post. A stolen authentication key makes that trick far more convincing. The darker risk is the wrench attack: someone turns up at the door and forces a transfer.
What to do now:
- Never type your seed phrase into a device you didn’t order, or into any website or app form.
- Ignore calls, texts, emails or letters about refunds, replacements, “asset migration” or “wallet verification.”
- Reach Keystone only by typing keyst.one yourself, or at [email protected].
- Don’t talk about your holdings in public, and use a pickup point for your next hardware order.
TRAIL MAP: The 10 Most Common Crypto Scams and How to Spot Them
Keystone says it will email affected buyers and open a page where anyone can check whether their data was in the Keystone data breach. Destroying 18,835 wallets is an expensive way to say sorry, and probably the right one. Whether the stolen key ever turns up inside a fake device is what Keystone owners should watch.
In crypto since 2016. Covers altcoins and the daily market. When not trading, out climbing and traveling.
More from Teddy →
