Keystone is set to destroy 18,835 unsold hardware wallets and suspend shipments after a security breach exposed customer information and a production key that could allow counterfeit devices to pass authenticity checks. The incident raises concerns about both customer privacy and the security measures used to verify genuine hardware wallets.
The breach occurred on October 20 through a vulnerability in a third-party data monitoring tool connected to the company’s website. Approximately 25,964 customer records covering 2024 to 2026 were exposed, including names, contact information, shipping addresses and order details. An additional 12,873 unpaid checkout records may also have been affected.
In this story
2 assets
The most serious concern involves a cryptographic key embedded in devices during production. Because this key cannot be changed, its exposure could allow counterfeit wallets to appear authentic during online verification. To address the risk, Keystone plans to destroy the affected unsold inventory rather than allow those devices to reach customers.
The company said recovery phrases, private keys and wallet credentials were not exposed. However, the incident also revealed a failure in its data retention process. Customer records that should have been deleted under the company’s 180-day retention policy remained stored because an automated deletion tool failed without the issue being detected. Keystone has acknowledged responsibility for not removing the data on time.
The incident comes amid growing security concerns for hardware wallet users. Other wallet providers have also faced phishing attempts, data exposure and software vulnerabilities. Such incidents demonstrate that protecting digital assets requires more than securing private keys: customer databases, device authentication systems and internal data management procedures can also create risks.
A separate breach disclosed by another hardware wallet manufacturer involved more than 23,000 phishing email attempts designed to appear legitimate. Investigators found no evidence that the incident compromised the manufacturer’s devices or private keys. However, older database copies that had not been removed under its 60-day deletion process contained approximately 5,600 mailing addresses and 5,200 phone numbers. The number of records actually accessed remained unconfirmed.
Keystone says devices delivered before October 20 remain safe to use if they pass the company’s authentication checks. Customers who received devices using the exposed key after that date should seek additional verification before using them. The company also stated that users do not need to transfer their funds solely because of this breach and warned them to be cautious of fraudulent recall notices or messages requesting asset migration.
The incident highlights an important distinction in crypto security: a hardware wallet may protect private keys while other parts of the surrounding system remain vulnerable. Device authenticity, customer data protection and reliable deletion procedures are all essential to maintaining user trust. For customers, the priority is to follow verified security guidance, avoid suspicious migration requests and never disclose recovery phrases in response to unexpected messages.
