Bitcoin hardware wallet manufacturer Keystone stated that after attackers obtain the keys necessary to prove the authenticity of their hardware, the company will destroy 18,835 unsold devices. The company has also suspended the shipment of all orders that have not yet been delivered on their website.

For buyers, the risk lies in the possibility of encountering a fake wallet that appears brand new and is able to pass the Keystone self-validation check, as attackers have obtained the keys that this check relies on. Criminals may then sell such devices to users who would put real assets into them.

Keystone stated in the declaration: 'If this key is leaked, attackers can use it to create counterfeit devices that can pass authentication checks. These devices may then be sold or sent to customers, who might use them as genuine products without knowing it, ultimately leading to the theft of assets.'

Keystone refers to this key as WebAuth key. In other words, it is a secret code written into each device during the manufacturing process, and pages on the website can be used to verify the authenticity of the hardware based on this code. This key cannot be erased or rewritten. The 18,835 devices in stock that contain this key will be destroyed rather than sold.

Keystone initially stated on Saturday that third parties had obtained customers' transportation information. A statement on Monday added that in addition to the stolen keys, there were also 25,964 affected buyer records, but the company did not identify the responsible party or when the attackers first made their intrusion.

This incident affected the Shopify store records of Keystone, which is managed by that e-commerce platform for its online sales. Keystone stated that a total of 51,083 buyer records were affected, but 25,119 of those records contained personal information that has been deleted. The remaining 25,964 records, dating from 2024 to 2026, still retain the buyer's name, contact information, delivery address, and order details. Purchases made through Amazon and other channels were not affected.

Some of this data should have been deleted already. According to the policy of Keystone, buyer records are supposed to be deleted after 180 days, but the automatic batch deletion tool developed by the company for this purpose is not stable.

Keystone indicates: 'Some deletion tasks failed, and we did not detect and address these failures in a timely manner, resulting in certain personal information being retained beyond the permitted period. We failed to fulfill our commitment to delete customer data on time and take responsibility for this failure.'

The customer list has always been a recurring weak point for wallet manufacturers. The data breach in 2020 by Ledger affected approximately 292,000 customers, and those who subsequently received phishing emails were concerned that they might become targets of targeted attacks.

Trezor and SafePal also disclosed customer data breaches in August, affecting 13,689 customers and approximately 39,798 customers respectively.

Names and addresses are important because of a phenomenon known as "nutcracker attacks" – where criminals use threats or violence to force holders to hand over their encrypted assets. According to Chainalysis, there were 46 violent attacks in the first half of 2026, resulting in the theft of over $30 million in funds.

The manufacturer also warned that scammers may offer so-called "asset migration," "wallet verification," or "investigation assistance."

The company stated: "We will not ask you to return the device. Anyone who contacts you under the pretext of a 'recall' and asks you to send them the device should be regarded as a scammer."

Keystone Sales on the website will be changed to pre-sales until all devices produced using the new keys are completed. The company also stated that reports have been submitted to regulatory authorities in the European Union, the United Kingdom, and other jurisdictions.

Keystone has shortened the retention period for customer data from 180 days to 90 days, and on October 24th, it requested that Shopify delete all buyer data that has been over-retained. There is a 10-day waiting period for this process, and the company expects the deletion to be completed by November 3rd.