Keystone updates its security incident response: it will destroy 18,835 old-key devices

Article

Keystone updates its security incident response progress: 18,835 old-key devices will be destroyed, and the customer information retention period will be shortened to 90 days

PANews October 26 reported that hardware wallet manufacturer Keystone released an update on its security incident response progress. It disclosed that the incident involved 25,964 buyer records containing personal information. Device verification keys obtained by the attacker could potentially be used to manufacture counterfeit devices that can pass verification on the official website. In response, Keystone will discontinue use of the old keys, destroy 18,835 inventory devices using the old keys, and suspend delivery of unshipped orders placed through its official website. Shipping will resume after devices using the new keys enter production. It will also shorten the customer personal information retention period from 180 days to 90 days. Keystone cautioned that devices received after October 20 that use old verification keys cannot be fully ruled out as counterfeit, even if they pass verification on the official website. Users should contact customer service for further confirmation.

Source: https://www.panewslab.com/zh/articles/01a1788c-79fe-749b-a08b-c553643d6e4c

Key points

Keystone disclosed that the incident involved 25,964 buyer records containing personal information.
Device verification keys obtained by the attacker could potentially be used to manufacture counterfeit devices that can pass verification on the official website.
Keystone will discontinue use of the old keys and destroy 18,835 inventory devices using the old keys.
Keystone has suspended delivery of unshipped orders from its official website and will resume shipping after new-key devices enter production.
The customer personal information retention period will be shortened from 180 days to 90 days.
October 20 For devices received after that using old verification keys, counterfeit risk cannot be fully ruled out even if they pass verification on the official website.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Keystone stated that after discovering the security incident, it will replace the device verification keys and destroy inventory devices using the old keys, while suspending some shipments. A device using an old key passing verification on the official website does not mean counterfeit risk can be completely ruled out.

Why it matters to readers

This may affect users' assessment of hardware wallet device verification and supply chain security.

If you use or plan to purchase a Keystone hardware wallet, you should monitor device keys, shipping status, and official verification channels.

Risks and unknowns

The material does not provide a link to Keystone's original security announcement.
The material does not state whether there have been any verified counterfeit devices or user asset losses.
The timing for new-key devices entering production and the resumption of unshipped orders has not been specified.

Keystone updates its security incident response: it will destroy 18,835 old-key devices

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center