coindesk.com
Hardware wallet maker Keystone said it will destroy almost 19,000 unsold devices and suspend shipments after a website breach exposed customer information and a key that could let counterfeit wallets pass authenticity checks.
An attacker gained access to the company’s website on Oct. 20 through a flaw in a third-party data monitoring tool, Keystone said Monday in a post on X. The attack exposed 25,964 buyer records from 2024 through 2026, including names, contact details, shipping addresses and order information. Another 12,873 unpaid checkout records may have been affected.
The breach adds to a string of attacks on hardware wallet users this year. At Ledger, criminals fitted devices sold through resellers in Southeast Asia, with hidden components capturing recovery phrases during setup. Similarly, a flaw in Coldcard’s seed-generation software let attackers reconstruct private keys and drain wallets remotely.
The stolen Keystone key is built into devices during production and cannot be changed. It allows wallets to pass online authenticity checks, raising the risk that fake devices could appear genuine and put users' funds at risk, according to the firm. The company said it will destroy 18,835 unsold units.
Keystone said the breach did not expose recovery phrases, private keys or wallet credentials.
Some customer records should have been deleted under Keystone's 180-day retention policy, but an automated deletion tool failed without the company detecting the issue, it said.
“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.
Keystone’s update came a day after hardware wallet maker Foundation disclosed a separate breach in which attackers sent phishing emails that appeared to come from its official domains.
Foundation said it had identified more than 23,000 phishing email attempts. It found no evidence that Passport devices or private keys were compromised.
Foundation also found older database copies that its 60-day data deletion process had missed. In an update, it said attackers could access records containing about 5,600 mailing addresses and 5,200 phone numbers, though it could not confirm how many were accessed.
Keystone said devices delivered before Oct. 20 remain safe to use if they pass authentication, while customers who received devices using the old key after that date should seek further checks before use.
The company said users do not need to move funds due to the breach alone and warned against fake recall or asset migration messages.
