Keystone confirms device authentication keys were compromised and will destroy 18,835 devices using the old keys

AT A GLANCE

Keystone says the security incident on its official website exposed some customer information and device authentication keys, and it will destroy 18,835 devices using the old keys.

Article

Keystone announces it will destroy 18800 devices, confirms device authentication keys were compromised

BlockBeats reports that October 26, the hardware wallet brand Keystone October 26 issued a security incident notice stating that its official website experienced a security incident on October 20. The attacker exploited a vulnerability in a third-party data monitoring tool used by the website to escalate privileges and obtain some customer information and keys used to verify device authenticity.

The incident involved 51,083 purchase records from the official website's Shopify store, of which 25,964 still contained personal information, including customer names, contact details, shipping addresses, and order information from 2024 to 2026. In addition, 12,873 abandoned checkout records containing personal information submitted by users were affected. Customer records for purchases made through Amazon and other sales channels were not affected.

Keystone stated that the device authentication keys obtained by the attacker could be used to manufacture counterfeit devices capable of passing authenticity verification. However, the incident did not involve mnemonic phrases, wallet private keys, or other wallet credentials, nor did it involve bank payment information or government-issued identification numbers.

As a response, Keystone will deactivate the old authentication keys, destroy 18,835 devices in inventory that use the old keys, and suspend delivery of unshipped orders from the official website until devices using the new keys enter production, after which shipments will resume. The company will also shorten the retention period for customers' personal information from 180 days to 90 days, and has submitted a data deletion request to Shopify, with the relevant deletion process expected to be completed on November 3.

Keystone warns that devices received after October 20 and using the old authentication keys may still pose a counterfeit risk even if they pass authentication; users should contact official customer support for further verification. The company emphasized that users do not need to move their assets solely because of this incident and should beware of scams conducted under the pretext of asset transfers, wallet verification, or device recalls.

Original link https://m.theblockbeats.info/flash/373792

Key points

Keystone said its official website experienced a security incident on October 20, in which the attacker exploited a vulnerability in a third-party data monitoring tool to escalate privileges.
The attacker obtained some customer information and keys used to verify device authenticity.
The incident involved 51,083 purchase records from the Shopify store, of which 25,964 still contained personal information.
Another 12,873 abandoned checkout records contained personal information submitted by users.
Customer records for purchases made through Amazon and other sales channels were not affected.
Keystone said the incident did not involve mnemonic phrases, wallet private keys, other wallet credentials, bank payment information, or government-issued identification numbers.
Keystone will deactivate the old authentication keys and destroy 18,835 devices in inventory that use the old keys.
Keystone will suspend delivery of unshipped orders from the official website and resume shipments once devices using the new keys enter production.
The retention period for customers' personal information will be shortened from 180 days to 90 days; Keystone expects the relevant deletion process to be completed on November 3.
Keystone warns that devices received after October 20 and using the old authentication keys may still pose a counterfeit risk even if they pass authentication.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Device authentication keys are used to help determine whether a hardware wallet is genuine. This announcement states that the key was obtained by attackers; therefore, verification with the old key is no longer sufficient to fully rule out counterfeit devices. Keystone plans to deactivate the old key, destroy the related inventory, and have some users contact official customer service for further verification. The announcement also states that wallet mnemonic phrases and private keys were not affected.

Why it matters to readers

The compromised authentication keys may undermine confidence in device authenticity verification; exposure of customer names, contact details, shipping addresses, and order information could also be used for targeted scams.

If you purchased or are waiting to receive a Keystone device, you should check whether the device uses the old authentication key and verify it through official customer service. Do not operate your wallet at the request of strangers citing asset migration, wallet verification, or device recall. The announcement states that users do not need to transfer assets solely because of this incident.

Risks and unknowns

It is not yet clear whether counterfeit devices manufactured or sold using the old authentication key have already appeared.
No direct link to Keystone's security incident announcement was provided; the disclosure was relayed by BlockBeats.
Has the Shopify-related data deletion process been completed as of November 3 completed; the original text does not provide the result.

Keystone confirms device authentication keys were compromised and will destroy 18,835 devices using the old keys

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center