Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
Keystone will destroy 18,835 unsold hardware wallets after hackers stole a device verification key, raising concerns about counterfeit devices. The breach also exposed shipping data for 25,964 customers.
Intelligence analysis by Gemini 2.5 Flash
A vulnerability in a third-party data monitoring tool allowed an attacker to steal Keystone's hardware wallet verification key, which could enable counterfeit devices to pass authenticity checks. The incident also led to the exposure of customer shipping and order details, prompting the company to destroy affected inventory and revise its data retention policies.
Imagine your special toy has a secret code to prove it's real. Someone sneaky stole that secret code, so now fake toys could pretend to be real ones! Because of this, the company has to destroy thousands of their real toys that have the old secret code. Also, the sneaky person peeked at some customer lists, like names and addresses, but not credit card numbers.
Analysis
Keystone's Verification Key
The core of the security incident revolves around the theft of a device verification key, which Keystone's hardware wallets use to prove their authenticity. This key is crucial because it allows an owner to scan a QR code with their device and verify its genuineness through an online check. The compromise means that an attacker could potentially manufacture counterfeit devices that would pass this verification process, deceiving buyers into using non-genuine hardware that could lead to the theft of their cryptocurrency.
Keystone has clarified that this stolen key does not play any role in generating recovery phrases, deriving private keys, or signing transactions, meaning existing genuine wallets are not directly compromised in terms of their cryptographic security. However, the risk lies in the potential for new, malicious devices to enter the market and appear legitimate. The company discovered the unauthorized access on October 20, but the attacker's initial entry point remains undisclosed, leaving a window of uncertainty regarding the duration of the compromise.
18,835 Devices Destroyed
In response to the key theft, Keystone has committed to destroying 18,835 unsold hardware devices that contain the compromised key. This drastic measure is necessary because the key is written into each device during manufacturing and cannot be erased or rewritten, nor can devices be updated with a new key. This means any device manufactured with the old key, even if genuine, carries a residual risk if it was received after the breach detection date.
New devices will be manufactured with a fresh, secure key, and shipping has been paused until these new units are ready. The company's guidance to customers varies based on when their device was received, with those receiving devices after October 20 being advised to contact support for confirmation of genuineness before use. This situation highlights the challenges of hardware security, where physical devices, once manufactured, cannot be easily updated to mitigate certain types of cryptographic compromises.
Shopify Data Breach
Beyond the hardware key compromise, the incident also involved a data breach affecting customer records. An attacker exploited a vulnerability in a third-party data monitoring tool used by Keystone's website, escalating privileges to obtain customer data. This breach impacted 25,964 buyer records from purchases made on Keystone's website between 2024 and 2026, as well as 12,873 unpaid checkout records.
The compromised data includes names, contact details, shipping addresses, and order specifics. Importantly, payment card, bank details, and government ID numbers were not involved, as these were handled by Shopify, Keystone's online store platform. The incident also exposed a failure in Keystone's automated data deletion tool, which was supposed to erase shipping information after 180 days but did not work reliably. Keystone is now shortening its data retention period to 90 days and has requested Shopify to delete older data, aiming to enhance customer privacy and data security practices moving forward.
Key points
- Keystone's hardware wallet device verification key was stolen by an attacker exploiting a third-party vulnerability.
- The company will destroy 18,835 unsold hardware wallets that contain the compromised key.
- The incident exposed names, contact details, shipping addresses, and order details for 25,964 buyer records and 12,873 unpaid checkout records.
- A failure in Keystone's automated data deletion tool meant some customer data was retained longer than promised.
- Keystone is implementing a new verification key for future devices and shortening its data retention period to 90 days.
Keystone's proactive decision to destroy 18,835 devices and implement a new verification key demonstrates a strong commitment to security and customer trust. The company is also addressing its data retention policy failures by shortening the storage period for personal data, which could lead to improved privacy practices.
The theft of a device verification key introduces a significant supply chain risk, potentially allowing counterfeit hardware wallets to enter the market and deceive users, leading to crypto theft. The data breach, coupled with the failure of automated data deletion, erodes customer trust and highlights vulnerabilities in third-party integrations and internal data management.
