Hackers stole the key Keystone wallets use to prove they are real, so the company will destroy 18,835 unsold devices. Some owners should wait before using theirs.
Keystone, a maker of hardware wallets for crypto, says hackers stole the secret key its devices use to prove they are genuine. The company will destroy 18,835 unsold devices that carry the key. Owners whose device arrived after October 20 should hold off on using it until Keystone confirms it is real. The company said no counterfeits or thefts have been reported.
A hardware wallet is a small device that stores the secret codes that control a person's crypto. Keystone's owners can check that their device is authentic. They scan a QR code on Keystone's verification page, then type in a code the device shows. A correct code means the device holds Keystone's key.
Anyone with a copy of that key could build a fake device that passes the same check. Keystone says such devices could be sold or shipped to customers, and a buyer who trusted one could lose their crypto. Keystone said the attacker got in through a flaw in a third-party data monitoring tool on its website. The company blocked the attacker and fixed the flaw on October 20.
Keystone says the key is used only for the authenticity check. It has no role in creating recovery phrases, deriving private keys or signing transactions, and none of those were exposed. A device delivered before October 20 that passes the check can be treated as genuine, according to Keystone. Payment card details, bank details and government ID numbers were not involved. Purchases from Amazon and other outside sales channels were not affected.
Keystone has not said when the attacker first got in, which is why the October 20 date matters so much. It also has not said where the key was stored. For a device that arrived after that date with the old key, the company said: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit."
The key is written into each device at the factory and cannot be erased or replaced, so devices already made cannot be switched to a new key. New devices will get a new one.
The breach also exposed 25,964 buyer records from Keystone's website, covering purchases from 2024 to 2026. They include names, contact details, shipping addresses and order details. Another 12,873 unpaid checkout records are included as a precaution.
Some of that data should already have been deleted. Keystone had promised to remove shipping information after 180 days, but its bulk deletion tool failed in places and the company missed it. It is cutting the period to 90 days and expects Shopify, which runs its store, to delete older data on November 3. As of October 27, its privacy policy still said 180 days.
The steps in the box above cover the date check and what to do next. Keystone is emailing affected customers and plans a page where people can see whether their information was involved. Until then, be cautious with unexpected messages about a Keystone order.
If your Keystone arrived after October 20, contact support and wait for the company's okay before using it.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
