Keystone Halts Shipments, Destroys 18,835 Wallets After Factory Attestation Key Theft

Hardware wallets live or die on a single assumption: the device in your hand is authentic. Keystone just showed how brittle that trust anchor can be. After detecting on October 20 that attackers obtained its permanent WebAuth key—the factory credential used to confirm units are genuine—the company is destroying 18,835 unsold devices and suspending shipment of all unshipped website orders. Recovery phrases and private keys were not involved, and Keystone says devices delivered before October 20 are unaffected.

The immediate risk is subtle but serious. With the stolen WebAuth key, an adversary can build or modify a wallet that passes Keystone’s own authenticity check and then sell it as new. A user could fund what looks like a valid device and later discover the wallet was booby-trapped. Because the WebAuth key is burned into hardware and cannot be erased or rewritten, Keystone chose to scrap all inventory carrying the compromised credential rather than gamble on downstream detection.

The breach also touched customer data held by Keystone’s Shopify store. In total, 51,083 buyer records were implicated; 25,119 had already had personal information erased. That leaves 25,964 records from 2024 to 2026 that still contained names, contact details, shipping addresses, and order information. Purchases through Amazon and other channels were not affected. Keystone says its policy was to delete buyer data after 180 days, but its automated bulk-deletion tool failed for some tasks. The firm has cut retention to 90 days, asked Shopify on October 24 to erase all overdue data (Shopify applies a 10-day waiting period), and expects completion by November 3. Reports have been filed with authorities in the EU, UK, and other jurisdictions.

Focus on the core failure mode: a single, permanent factory key as the root of trust. It’s convenient for web-based device verification, yet it concentrates risk. Once exposed, counterfeiters can produce units indistinguishable to Keystone’s own checks. A sturdier approach would distribute attestation—per-device or per-batch keys with revocation and transparency, ideally anchored in a secure element and audited publicly. Open attestations, reproducible firmware builds, and independent validation would give users multiple lines of defense rather than a binary “green checkmark” on a webpage. Until the industry normalizes those patterns, brand reputation becomes the backstop.

There is also a human layer. Many users conflate “genuine” with “safe.” After an incident like this, that shortcut becomes dangerous. Expect phishers to weaponize the news with offers of “asset migration,” “wallet verification,” or “investigation assistance.” Keystone has been explicit: it will not ask customers to return devices, and any “recall” request should be treated as a scam. The address exposure amplifies physical risk too. Chainalysis counted 46 violent, crypto-related “wrench attacks” in the first half of 2026, with over $30 million stolen. Names and shipping locations make targeting easier.

From a business standpoint, destroying nearly nineteen thousand units and moving web sales to preorders until devices with a new key roll off the line will sting. But it likely contains longer-tail damage. Wallet makers have learned this lesson repeatedly: Ledger’s 2020 leak reached roughly 292,000 customers; Trezor and SafePal each reported August breaches affecting 13,689 and about 39,798 customers, respectively. Customer lists and single-point attestations are recurring weak spots. Firms that minimize retained data, prove deletion, and decentralize trust anchors will be more durable through the next cycle of attacks.

What should current and prospective users do? If you received a Keystone device before October 20, the company says it is outside the scope of this compromise. Do not share your recovery phrase with anyone, ignore any outreach asking you to return a device, and source hardware only from trusted channels. For new purchases, wait for Keystone’s next manufacturing run using a new WebAuth key—and press for details on per-device attestations and revocation. The industry needs to make “trust, but verify” an actual system property, not a marketing line.