Keystone to destroy 18,835 wallets after key theft

• Keystone will destroy 18,835 unsold hardware wallets after an attacker obtained its device-authentication key.
• The breach exposed 25,964 buyer records containing personal information, alongside 12,873 incomplete checkout records.
• Keystone has suspended shipments of affected inventory and plans to use a replacement authentication key for new devices.

Keystone Hardware Wallet will destroy 18,835 unsold devices after an attacker obtained its WebAuth authentication key, raising counterfeit-device risks.

The breach also exposed 25,964 buyer records containing personal information and 12,873 incomplete checkout records.

“The attacker also obtained the WebAuth key we use to verify whether a device is genuine,” Keystone said in its security update.

The stolen key could allow counterfeit devices to pass Keystone’s online authenticity checks.

Keystone said its automated data-deletion tool “did not operate reliably”, leaving some personal information stored beyond its intended retention period.

The exposed records included names, contact details, shipping addresses and order information, while payment details, recovery phrases and private keys were not exposed, according to Keystone.

The company has suspended affected shipments, plans to replace the compromised key in new devices and will destroy the existing unsold inventory.

Keystone’s response now centres on removing affected inventory and restoring confidence in its device-authentication process.