Bitcoin hardware wallet manufacturer Keystone has suspended shipping and ordered the destruction of 18,835 unsold devices after attackers obtained a permanent factory authentication key. The breach, detected on October 20, also exposed personal data for 25,964 buyers from its Shopify store between 2024 and 2026 due to failed automated data erasure processes.
The company confirmed that recovery phrases and private keys were not compromised, meaning devices delivered before October 20 remain unaffected. However, the stolen key allows criminals to produce counterfeit units that pass genuine verification checks, prompting Keystone to switch website sales to preorders while it manufactures devices with a new security key.
Key facts
- Attackers obtained the permanent factory authentication key used to verify device genuineness.
- Keystone will destroy 18,835 unsold hardware wallets currently in inventory.
- Personal records for 25,964 buyers from 2024 to 2026 were affected by the breach.
- Shipping of all unshipped orders from the company website has been suspended.
- Keystone stated that recovery phrases and private keys were not involved in the incident.
- The company reduced its customer data retention period from 180 days to 90 days.
Why it matters
The theft of the factory key creates a risk of counterfeit wallets that appear genuine and pass official verification checks, which could lead to asset theft if users load real savings onto these fraudulent devices.