Keystone Wallet Website Breach Exposes 25,964 Buyers' Details and Its Device-Check Key: What to Do

TL;DR: Keystone, which makes air-gapped crypto hardware wallets, says an attacker broke into its official website on October 20, 2026 through a flaw in a third-party data monitoring tool. The attacker got names, contact details, shipping addresses and order information for 25,964 buyers from its Shopify store, plus 12,873 unfinished checkouts, and the WebAuth key Keystone uses to prove a device is genuine. Keystone says recovery phrases and private keys weren’t involved and you don’t need to move your crypto. If a Keystone device reached you after October 20, contact Keystone support to verify it before you use it, and expect targeted scam messages that quote your real order.

What happened

Keystone published its statement on its official X account on October 26, 2026. It says its monitoring spotted “unusual access to the official website” on October 20. Keystone says that the same day it disabled sensitive website functions and blocked the access points. It says it fixed the vulnerability but hasn’t said when. Its investigation found the attacker “exploited a vulnerability in a third-party data monitoring tool used by our website to escalate privileges.” Keystone hasn’t named the tool.

The attacker reached 51,083 buyer records from purchases on Keystone’s Shopify store. Keystone says personal details had already been erased from 25,119 of them under its retention policy. The other 25,964, covering 2024 to 2026, still held names, contact details, shipping addresses and order information. They should have been erased after 180 days, but Keystone says the automated tool it built to bulk-erase old records “did not operate reliably,” and it didn’t notice the failures in time. Shopify had also kept 12,873 checkout records where payment was never completed, with names, contact details and shipping information. Keystone says “Customer purchase information from Amazon and other sales channels was not affected.”

The more serious loss is the device key. Keystone says the attacker also took the WebAuth key behind its device authentication page. The key is written into each device at the factory and can’t be changed. It’s only used to check that a device is genuine, not to create recovery phrases, derive private keys or sign transactions. But with it, Keystone says, an attacker “could use it to produce counterfeit devices that pass authentication checks,” which could then be sold to customers and used to steal their funds.

Keystone says it has stopped using the old key in production, will destroy the 18,835 devices in stock that carry it, and has suspended shipping of all unshipped website orders. Sales move to preorders until devices with a new key are made. On October 24 it asked Shopify to erase buyer data older than 90 days, which Keystone expects to complete on November 3 after Shopify’s 10-day wait, and it is cutting its retention period from 180 to 90 days. It says it will email affected customers, launch a page to check whether you were affected, and has reported the incident in the EU, the UK and other jurisdictions. Earlier, in an X post on October 24 US time (October 25, 1:59 a.m. Manila), Keystone had said that it confirmed on October 23, “After verifying API activity with Shopify,” that a third party had obtained customer shipping information, and warned customers about scammers posing as Keystone.

Why it matters

Two groups should pay attention. If your business holds crypto on Keystone devices, the stolen key weakens the one check that tells you a new device hasn’t been tampered with, so any device delivered after October 20 needs Keystone to vouch for it. And the leaked data is exactly what phishers want: a real name, address and order history make a fake “recall” or “wallet verification” message very convincing.

For anyone running an online store, this is a useful warning. The way in was a third-party monitoring tool on the website, not the shop platform itself, and much of the damage came from data that should already have been deleted. A clean-up job that fails silently looks fine until there’s a breach. Our Security hub collects other incidents and patches worth acting on.

What to do now

1. Check when your device arrived. Keystone’s guidance hinges on October 20, 2026. A device delivered before then that passes the check on keyst.one/authentication can be considered genuine and used normally, Keystone says.
2. Verify anything delivered after October 20. Keystone says that even if such a device passes the check, it “cannot completely rule out the possibility that it is counterfeit.” Follow the instructions on the authentication page to contact support, or email [email protected], and only use the device once Keystone confirms it.
3. Don’t move funds in a panic. Keystone says recovery phrases, private keys and wallet credentials weren’t involved and you don’t need to move assets because of this incident. Never type a recovery phrase into a website, email reply or chat, whatever the message says.
4. Expect scams that know your order. Keystone says it won’t ask you to return your device, so a “recall” request is a scam. Ignore calls or messages offering “asset migration,” “wallet verification” or “investigation assistance,” and reach Keystone by typing keyst.one yourself.
5. If you run a store, check your own clean-up jobs. Our advice: list the third-party scripts and tools that have access to your store’s admin or customer data and remove any you don’t need, and check that any data-deletion or retention task alerts you when it fails rather than failing quietly.

Updates

• Oct 28, 2026, 7:18 a.m. Manila: First published. Keystone hasn’t given dates for its breach lookup page or erasure status page, and it said on X on October 27 that it is “working on the device verification part” and “More details will be shared in the upcoming days.” We’ll add a dated note when those arrive.

Sources & method

Sources

• Keystone on X, “Statement Regarding the Security Incident on Our Official Website and Customer Guidance” (October 26, 2026)
• Keystone on X, scam warning after order shipping information was obtained (October 24, 2026, 17:59 UTC; October 25 in Manila)
• Keystone on X, reply on device verification (October 27, 2026)
• Keystone device authentication page

Method. Last checked October 28, 2026, at 7:18 a.m. Manila time (October 27, 23:18 UTC). Every figure, date and quote about the incident comes from Keystone’s own statement and posts on its official X account; we haven’t seen an independent investigation. Keystone hasn’t named the third-party tool, and there’s no CVE. Steps labelled “our advice” and step 5 are our own advice, not Keystone’s. The thumbnail is the cover image of Keystone’s statement, fitted to our 16:9 frame with a flat colour fill and not cropped. No affiliate links on this page. How we work.