Crypto wallet maker Keystone to destroy almost 19,000 devices after security breach
The breach exposed 25,964 buyer records, some kept past Keystone’s 180-day deletion policy after an automated tool failed without the firm noticing.
Hardware wallet maker Keystone said it will destroy almost 19,000 unsold devices and suspend shipments after a website breach exposed customer information and a key that could let counterfeit wallets pass authenticity checks.
An attacker gained access to the company’s website on Oct. 20 through a flaw in a third-party data monitoring tool, Keystone said Monday in a post on X. The attack exposed 25,964 buyer records from 2024 through 2026, including names, contact details, shipping addresses and order information. Another 12,873 unpaid checkout records may have been affected.
The breach adds to a string of attacks on hardware wallet users this year. At Ledger, criminals fitted devices sold through resellers in Southeast Asia, with hidden components capturing recovery phrases during setup. Similarly, a flaw in Coldcard’s seed-generation software let attackers reconstruct private keys and drain wallets remotely.
The stolen Keystone key is built into devices during production and cannot be changed. It allows wallets to pass online authenticity checks, raising the risk that fake devices could appear genuine and put users' funds at risk, according to the firm. The company said it will destroy 18,835 unsold units.
Keystone said the breach did not expose recovery phrases, private keys or wallet credentials.
Some customer records should have been deleted under Keystone's 180-day retention policy, but an automated deletion tool failed without the company detecting the issue, it said.
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.
Keystone’s update came a day after hardware wallet maker Foundation disclosed a separate breach in which attackers sent phishing emails that appeared to come from its official domains.
Foundation said it had identified more than 23,000 phishing email attempts. It found no evidence that Passport devices or private keys were compromised.
Foundation also found older database copies that its 60-day data deletion process had missed. In an update, it said attackers could access records containing about 5,600 mailing addresses and 5,200 phone numbers, though it could not confirm how many were accessed.
Keystone said devices delivered before Oct. 20 remain safe to use if they pass authentication, while customers who received devices using the old key after that date should seek further checks before use.
The company said users do not need to move funds due to the breach alone and warned against fake recall or asset migration messages.
Keystone will replace the authentication key in new devices, shift website sales to preorders and cut customer data retention to 90 days, it added.
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Asanat Analysis — Why it matters
Keystone's security incident reflects a critical vulnerability in hardware wallet supply chains: the attack surface extends beyond cryptographic isolation to encompass customer data retention and operational oversight. The 180-day deletion policy failure signals inadequate monitoring of automated systems—a recurring pattern in security breaches where policies exist on paper but lack enforcement mechanisms. Destroying 19,000 devices, while costly, is a necessary containment measure that prevents compromised firmware or supply-chain tampering from reaching end-users.
This incident carries second-order implications for the hardware wallet sector. It reinforces that device manufacturers now face dual accountability: secure key management AND secure data hygiene. The breach may accelerate regulatory scrutiny around personal data handling in crypto infrastructure, particularly as European and Asia-Pacific regulators tighten privacy frameworks. Competitors like Ledger and Trezor will likely face increased pressure to publicly audit their data retention practices, while users may reassess whether purchasing from established players justifies potential scale-related risks versus emerging alternatives.