started · updated
Keystone hardware wallet manufacturer suffers data breach and key theft
Keystone, a cryptocurrency hardware wallet manufacturer, has disclosed a significant security breach involving its Shopify-powered online store. The unauthorized access, detected on October 20, 2026, resulted in the exposure of 25,964 purchase records and 12,873 incomplete checkout records. The compromised data includes customer names, contact details, shipping addresses, and order specifics such as items purchased and prices.
Beyond personal data, the attacker also stole a WebAuth device-authentication key used to verify the authenticity of Keystone hardware. This theft creates a risk that counterfeit or cloned devices could pass the company’s official verification checks. In response, Keystone announced it will destroy 18,835 unsold hardware wallet units from its current inventory that rely on the compromised key and has suspended all website shipments until new devices with a replacement key are produced.
Keystone emphasized that private keys, recovery phrases, and banking information were not compromised. However, the breach has raised questions regarding the company’s data retention policy. While Keystone has marketed a promise to automatically delete shipping data after 180 days, multiple customers reported receiving breach notifications for orders placed over two years ago, suggesting a potential failure in their data erasure protocols.
Entities
Cloudflare · Hong Kong · Keystone · Keystone Hardware Wallet · Shopify · Taylor Monahan · WebAuth
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 3 SOURCES] Keystone will destroy 18,835 unsold hardware wallets due to the authentication key breach. crypto.news · www.crypto-insiders.nl · ethnews.com
- [● 3 SOURCES] The breach affected 25,964 customer purchase records. crypto.news · www.crypto-insiders.nl · ethnews.com
- [● 2 SOURCES] Customers reported receiving breach notifications for orders placed more than two years ago. blockcast.it · www.blocktempo.com
- [● 15 SOURCES] Private keys, recovery phrases, and payment details were not compromised. blockcast.it · blockzeit.com · crypto.news · www.crypto-insiders.nl · ambcrypto.com · +7 more
- [● 3 SOURCES] A stolen WebAuth authentication key could allow counterfeit devices to pass verification. crypto.news · www.crypto-insiders.nl · ethnews.com
- [● 17 SOURCES] Keystone detected unauthorized website access on October 20, 2026. blockcast.it · blockzeit.com · crypto.news · www.crypto-insiders.nl · ambcrypto.com · +10 more
- [● 10 SOURCES] Keystone confirmed the breach after reviewing Shopify API activity. blockzeit.com · blockonomi.com · cryptobriefing.com · blockcast.it · www.kriptoworld.hu · +4 more
- [● 18 SOURCES] The breach exposed names, contact details, shipping addresses, and order information. blockcast.it · blockzeit.com · crypto.news · www.crypto-insiders.nl · ambcrypto.com · +11 more
- [● 13 SOURCES] Keystone's breach exposed 25,964 purchase records. www.tronweekly.com · www.kriptoworld.hu · cryptocompass.com · btcwires.com · www.cryptobreaking.com · +8 more
- [● 11 SOURCES] A stolen WebAuthn authentication key allows for potential counterfeit wallet risks. www.tronweekly.com · www.geeklando.com.br · gizmodo.com · cryptocompass.com · www.bitcoinbazis.hu · +6 more
- [● 12 SOURCES] Keystone is destroying nearly 19,000 unsold units due to the security breach. www.geeklando.com.br · gizmodo.com · cryptocompass.com · www.bitcoinbazis.hu · btcwires.com · +7 more
- [● 2 SOURCES] Foundation experienced phishing emails that appeared to come from its own domains. www.geeklando.com.br · gizmodo.com