Stolen key weakens Keystone hardware wallet authenticity check
A Keystone hardware wallet authenticity check was compromised after an attacker obtained the secret used by devices to prove that they are genuine. Someone holding a copy could manufacture a counterfeit wallet that passes Keystone's online device verification process, potentially misleading a buyer into trusting hardware designed to steal cryptocurrency. Keystone said the incident did not expose recovery phrases, which restore access to a wallet, or private keys, the secret values that authorize transactions.
Keystone detected unauthorized access to its website on October 20. According to the company, the attacker exploited a vulnerability in a third-party data monitoring tool and used privilege escalation, meaning they gained more access than the compromised component should have allowed. The access exposed customer information and the device verification secret. Keystone blocked the attacker on October 20 and says the vulnerability has been fixed, but it has not disclosed when the intrusion began or where the secret was stored.
The verification process asks an owner to scan a QR code from Keystone's website with the hardware wallet and then enter the code shown by the device back into the page. Keystone's open-source firmware, the software built into the wallet, shows that the QR code contains an encrypted value. The device uses its stored secret to decode that value and produce the expected response. A correct answer therefore demonstrates only that the device possesses the verification secret.
That distinction is now critical. Because the attacker obtained the same secret, it could be placed in a counterfeit device that generates valid responses. Keystone said such hardware could then be sold or shipped to customers and used to steal their cryptocurrency. The company has not reported finding any counterfeit devices or any theft resulting from the incident. The compromised secret is not used to generate recovery phrases, derive private keys or approve transactions.
Keystone writes the verification secret into memory during manufacturing. That memory can be programmed only once, and the firmware rejects an attempt to install another secret. Consequently, completed devices cannot be converted to the replacement system. Keystone plans to destroy 18,835 unsold devices containing the compromised secret, while newly manufactured units will receive a different one.
The company's guidance depends primarily on delivery time. A wallet delivered before October 20 can be used normally if it passes the online verification check, Keystone said. For a device received after October 20 that contains the old secret, a successful check is no longer sufficient to exclude the possibility of a counterfeit. Its owner should not use it until Keystone support confirms that it is genuine.
Important details remain unresolved for this second group. Keystone has not explained how an owner can determine whether a device contains the old or new verification secret. It directed affected customers to its device verification page, but that page did not display the promised instructions as of October 27. The company also has not said what someone should do if cryptocurrency has already been transferred to a post-October 20 device carrying the old secret.
Shipping for orders placed through Keystone's website is paused until devices with the replacement secret are available. As of October 27, the online store described the Keystone 3 Pro as a pre-order expected to ship in four to six weeks. The same delivery-date guidance applies to purchases from Amazon official stores and authorized resellers. Keystone has not said whether old-secret devices remain available through those channels. Owners do not need to move cryptocurrency solely because of the breach, although anyone with a relevant post-October 20 delivery should follow the additional verification guidance.
The intrusion also exposed customer records. Keystone initially disclosed on October 24 that a third party had obtained shipping information. On October 26, it said 25,964 buyer records from website purchases made between 2024 and 2026 were affected. Those records contained names, contact information, shipping addresses and order details. Shopify operated the store and stored and managed the records. Keystone said payment card information, bank details and government identification numbers were not involved, while purchases through Amazon and other sales channels were unaffected.
As a precaution, Keystone included another 12,873 unpaid checkout records in its response. These came from transactions that were started but never completed and contained names, contact details and shipping information. Some records should already have been removed under Keystone's promise to erase shipping details 180 days after an order. However, its automated bulk-deletion tool did not work reliably, some removal attempts failed, and the company did not identify those failures in time.
Keystone has now shortened its personal-data retention period from 180 days to 90 days. It asked Shopify to remove buyer information older than 90 days and expected that work to be completed on November 3, although the privacy policy still stated 180 days as of October 27. The company is emailing affected customers and plans to provide a page where people can check whether their information was included. For organisations applying these lessons to their own web operations, AEU-I offers security-first IT, infrastructure and consulting.
Customers should also expect criminals to exploit the confusion around the incident. Keystone says messages offering refunds, replacement devices, recalls, wallet checks or assistance moving cryptocurrency should be treated as scams. It will not ask owners to return a wallet. Users should type keyst.one directly into the browser rather than follow links, and should never enter a recovery phrase into a device they did not order.