SECURITY ALERT · UPDATE

The seeds were never the target.

The proof of authenticity was.

Keystone says the attacker who got into its official website also obtained the WebAuth key it uses to check whether a Keystone hardware wallet is genuine. The company disclosed it in a statement posted on X at 14:02 UTC (15:02 CET) on 26 Oct.

That is new. When Keystone first disclosed the breach on Saturday, it spoke only of names, contact details, addresses and orders.

Keystone says recovery phrases, private keys, wallet credentials, bank payment details and ID numbers were not involved. It says users do not need to move funds because of the incident.

What changed, in UTC

  • 20 Oct. Keystone’s monitoring detects unusual access to its website. It says it disabled sensitive functions, blocked the access points and fixed the vulnerability the same day.
  • 24 Oct, 17:59. First public disclosure: customer shipping data taken.
  • 24 Oct. Keystone asks Shopify, which ran its web store, to erase overdue buyer data. Shopify’s 10-day waiting period means completion is expected on 3 Nov.
  • 26 Oct, 14:02. Full statement: the attacker exploited a flaw in a third-party monitoring tool running on the website to gain higher privileges, then took customer records and the authentication key.

So how many people are exposed?

The numbers, reconciled

The attacker reached 51,083 buyer records from the Shopify store, Keystone says.

Personal data had already been erased from 25,119 of them. The other 25,964 still held names, contact details, shipping addresses and order information, covering 2024 to 2026.

Keystone also found 12,873 checkout records where payment was never completed. Those people will be warned by email, it says.

Orders through Amazon and other channels were not affected, according to the statement.

Here the record and the promise part ways. Keystone had told customers that shipping data was deleted 180 days after an order. On Sunday, The Block reported customers saying older orders had leaked.

Keystone now confirms it. An automated bulk-erasure tool “did not operate reliably,” it says, and the failures were not caught in time. It is cutting retention from 180 days to 90.

Why does a stolen key matter more than a stolen address?

The counterfeit problem

The WebAuth key is written into each device at the factory and cannot be erased or rewritten. It does not generate seeds, derive keys or sign transactions.

It does one job: it lets Keystone’s authentication page tell a genuine device from a fake.

With that key, Keystone says, an attacker could build counterfeit wallets that pass the check. A buyer who trusted such a device could lose everything on it.

Keystone has not said that any counterfeit has been found.

Its response is drastic. New devices will use a new key, and the 18,835 units in inventory with the old key will be destroyed.

Shipping of unshipped website orders is suspended, and sales move to preorder until new-key production is done.

Earlier this month, Ledger’s warning about the CryptoBilis implant showed what a doctored signer can do.

What should owners do with the device they already have?

Protect yourself

  • Delivered before 20 Oct: Keystone says these devices are unaffected. If one passes authentication, it can be treated as genuine.
  • Received after 20 Oct with the old key: passing the check is no longer enough, Keystone says. Contact its support through the authentication page for extra verification before using it.
  • There is no recall. Keystone says it will not ask you to return a device. Anyone asking you to post one back is a scammer.
  • Never type a recovery phrase into a device you did not order, a website or a form. Our guide on what a private key is explains why.
  • Expect phishing that knows your name and order. Earlier on Monday, Foundation issued a similar warning about emails sent from its own domains.

Keystone says it has reported the incident to authorities in the EU, the UK and elsewhere. It plans a lookup page where customers can check whether their data was affected.

If a wallet maker’s proof of authenticity can be copied, what is left to trust except the supply chain?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.