# Keystone hardware wallet security breach

> Live situation record from CLSTR: https://clstr.news/situations/20261027-keystone-hardware-wallet-security-breach
> Updated: 2026-10-27T15:45:01.000Z. Sources: 29. Developments: 2.

Keystone, a manufacturer of cryptocurrency hardware wallets, disclosed a significant security breach involving its Shopify-powered online store. The unauthorized access, detected on October 20, 2026, exposed approximately 25,964 purchase records and 12,873 incomplete checkout records, including customer names, contact details, and shipping addresses.

A critical aspect of the breach involved the theft of a WebAuth device-authentication key used to verify hardware authenticity. Because this key is engraved into the hardware and cannot be modified, the theft created a risk that counterfeit or cloned devices could pass official verification checks. 

In response, Keystone announced it would destroy 18,835 unsold hardware wallet units from its current inventory that rely on the compromised key and suspended all website shipments until new devices with a replacement key could be produced. While the company stated that private keys, recovery phrases, and banking information were not compromised, the incident raised concerns regarding data retention, as some customers reported receiving breach notifications for orders placed over two years ago.

## Claims

- Keystone will destroy 18,835 unsold hardware wallets. (corroborated by 2 sources)
- Keystone has suspended all shipments from its website. (corroborated by 2 sources)
- The security breach was detected on October 20, 2026. (corroborated by 2 sources)
- The breach exposed 25,964 buyer records from 2024 to 2026. (corroborated by 2 sources)
- Exposed customer data includes names, contact details, and shipping addresses. (corroborated by 2 sources)
- Keystone claims that recovery phrases and private keys were not exposed. (corroborated by 2 sources)
- The hack occurred via a vulnerability in a third-party data tracking tool. (single source)
- An attacker obtained a WebAuth key used to verify device authenticity. (single source)

## Timeline

### 2026-10-27: Keystone to destroy 18,835 hardware wallets following security breach

Keystone is destroying 18,835 unsold hardware wallets and suspending shipments after a hack exposed an authenticity key and over 25,000 customer records.

4 sources. https://clstr.news/cluster/keystone-to-destroy-18835-hardware-wallets-following-security-breach

### 2026-10-24: Keystone hardware wallet manufacturer suffers data breach and key theft

Keystone hardware wallet maker faces a major breach exposing 25,964 customer records and a device authentication key, forcing the destruction of 18,835 unsold units to prevent counterfeit risks.

26 sources. https://clstr.news/cluster/keystone-hardware-wallet-discloses-website-data-breach

---
Cite as: Keystone hardware wallet security breach. CLSTR, https://clstr.news/situations/20261027-keystone-hardware-wallet-security-breach