**Keystone**, a prominent hardware wallet manufacturer, has revealed that an attacker gained unauthorized access to its website, compromising a critical key used to authenticate its devices. This breach, discovered on October 20, also led to the exfiltration of customer data, including shipping information. ### Authentication Key Compromise: A Supply Chain Threat The most significant aspect of the breach is the theft of the key used by **Keystone** hardware wallets to prove their genuineness during an online verification check. An adversary possessing this key could potentially manufacture counterfeit devices that would pass **Keystone**'s authentication process. While the company stated that the incident did not involve users' recovery phrases or wallet private keys, a buyer trusting a counterfeit device could have their crypto assets stolen. In response, **Keystone** has announced it will destroy 18,835 unsold devices that carry the compromised key. All new devices will be manufactured with a new, secure key. For devices received after October 20 that still contain the old key, **Keystone** advises extreme caution: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit." Owners of these devices are urged to contact **Keystone** support and refrain from using them until authenticity is confirmed. Devices delivered before October 20 that pass the check can be considered genuine. ### How the Device Check Works The **Keystone** device verification process involves scanning a QR code on the company's website with the hardware wallet and then entering a code displayed by the device onto the webpage. As detailed in **Keystone**'s open-source firmware, the QR code contains an encrypted code that the device decrypts using its stored key. A correct code confirms the device holds the legitimate key. Crucially, this key is used *only* for device authentication and plays no role in generating recovery phrases, deriving private keys, or signing transactions. However, anyone with a copy of the key could produce the correct codes, allowing a counterfeit device to bypass the check. The key is written into each device during manufacturing and cannot be erased or rewritten, meaning existing devices cannot be updated with the new key. ### Customer Data Exposed Beyond the authentication key, the attacker also gained access to customer data. **Keystone** initially disclosed on October 24 that a third party had obtained customers' shipping information. On October 26, the company confirmed that 25,964 buyer records from purchases made on its website between 2024 and 2026 were affected. These records include names, contact details, shipping addresses, and order specifics. **Keystone**'s online store operates on **Shopify**, which stored and managed these records. Importantly, payment card details, bank information, and government ID numbers were not compromised. Purchase records from **Amazon** and other sales channels were unaffected. An additional 12,873 unpaid checkout records, containing names, contact details, and shipping information from incomplete purchases, were also included in the breach response out of an abundance of caution. **Keystone** also admitted that some of the affected data should have already been deleted, as its privacy promises stated shipping information would be deleted 180 days after each order. An automated tool designed for bulk record erasure failed to work reliably, leading to retention failures. The company is now shortening its data retention period for personal data from 180 to 90 days and has requested **Shopify** to delete older buyer data. ### Recommendations for **Keystone** Owners **Keystone** has issued specific guidance for its users: * **Devices delivered before October 20:** If the device passes the authentication check, it can be used normally. * **Devices received after October 20 with the old key:** Do not use the device until **Keystone** support ([email protected]) confirms its authenticity. The company's device verification page currently lacks specific instructions for these users. * **Pending orders from Keystone's website:** Shipping is paused until devices with the new key are ready. * **Purchases via Amazon or resellers:** The same guidance applies based on the device's arrival date. * **Existing crypto holdings:** Users do not need to move their crypto solely due to this incident, unless their device falls into the "received after October 20 with old key" category. * **Scam awareness:** Be highly suspicious of any unsolicited communication (calls, texts, emails) offering refunds, replacements, or help with moving crypto. **Keystone** will not ask users to return devices or enter recovery phrases into unverified devices. Always type `keyst.one` directly into your browser. This incident underscores the complex challenges of securing the entire supply chain for hardware-based security solutions and the ongoing need for robust data retention and deletion policies.