Keystone to destroy 18,835 unsold hardware wallets after attacker obtains verification key
Owners of recently delivered devices are asked to hold off using them until Keystone support confirms they are genuine.
Keystone says an attacker who got into its website obtained the key its hardware wallets use to prove they are genuine, and it will destroy 18,835 unsold devices carrying that key while giving new devices a new one. Owners whose device arrived after October 20 with the old key are told not to use it until Keystone support confirms it is authentic, since a counterfeit built with the key could pass the online check. Devices delivered before October 20 that pass the check can be treated as genuine. Keystone also disclosed that 25,964 buyer records from 2024 to 2026 held names, contact details and shipping information, with payment and government ID data not involved. It reports that an internal tool meant to delete shipping records after 180 days did not work reliably, and it is cutting retention to 90 days.
Why it matters
For people who buy hardware wallets, the case shows that a device's proof of authenticity depends on a secret held by the vendor, so a breach of the vendor's website can undermine it. Buyers who received a unit after October 20 now have to rely on direct confirmation from Keystone before trusting it, while earlier buyers can rely on the online check. The incident also shows that data retention policies can fail in practice, which is why Keystone is cutting how long it keeps customers' shipping details. Taken together, the event shifts some trust from the device itself to the vendor's ongoing security.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.