Keystone Is Destroying 18,835 Hardware Wallets Because a Stolen Key Can Make a Counterfeit Pass Its Genuineness Check

Keystone published a security update on 26 October that ends with a line no hardware wallet buyer expects to read: 18,835 devices already built and sitting in inventory will be destroyed. Not recalled from customers, not patched with a firmware push, destroyed. The reason is that whoever breached the company's website also took the WebAuth key Keystone uses to prove a device is genuine, and that key is written into hardware during manufacturing and cannot be erased or rewritten afterwards. New production runs will use a new key, and shipments are suspended until they do.

The key that cannot be changed

The WebAuth key has exactly one job. A buyer opens Keystone's authentication page, scans a QR code, types in the code the device displays, and checks the answer that comes back. The whole chain exists to separate a real wallet from a convincing fake. Anyone holding the key can build counterfeit units that answer correctly, which is why the company chose to write off the inventory rather than ship it.

Keystone was equally clear about what the key is not. It plays no part in generating recovery phrases, deriving private keys or signing transactions, and those keys are created at initialisation, long after the device leaves the factory. The company says no payment data and no wallet credentials were exposed, and no on-chain theft has been reported. That distinction matters: the seed phrases on wallets already in customers' hands were not touched. What broke is narrower and much harder to explain to a buyer. For devices carrying the old key, passing a genuineness check no longer proves anything.

Four days between a website problem and a scrapped inventory

The timeline is painfully short. Unauthorized access to Keystone's website was detected on 20 October, through a vulnerability in a third-party data monitoring tool the company was running. By 23 October it had confirmed that customer shipping data left through its Shopify store. A statement on 24 October said payment details and private keys were untouched, and warned customers about callers offering refunds and replacement hardware, the classic follow-up act after a list of addresses leaks. The 26 October update added the part that costs real money: the authentication key was gone too.

25,964 purchase records that should already have been gone

The same update put numbers on the data side. Records tied to 25,964 purchases and 12,873 abandoned checkouts were exposed, covering names, contact details, shipping addresses and order contents. Keystone's policy promised deletion after 180 days. Its automated purge tool, the company has now admitted, was not working reliably, so personal records sat in the system long past the window that was supposed to protect them. Retention has been cut to 90 days and the company says it has requested deletion of everything overdue. Anyone whose order shows up in that set should assume their home address is in someone else's spreadsheet, because it is.

Foundation had the same week

Hours later, rival maker Foundation disclosed a separate incident. Attackers used compromised Cloudflare API credentials to send more than 20,000 phishing messages from the company's own domain, dressed up as a warning about Passport device display modules. Its 60-day deletion promise had the same hole as Keystone's 180-day one: legacy database migrations left unredacted copies of customer records sitting where they should never have been, alongside what Foundation described as a possible Shopify order leak.

2026 has been a rough year for the box that holds your keys

None of this is happening in isolation. Coinkite's Coldcard spent the summer as the largest hardware wallet exploit on record: a build configuration error from March 2021 sent seed generation to a software random number generator instead of the device's hardware entropy source, cutting effective key strength to as little as 40 bits. TRM Labs tracked roughly 1,816 BTC, about $116 million, leaving more than 5,200 addresses in four waves between 30 July and 4 August. Trezor's failure was further down the chain: a breach at shipping partner ShipMonk exposed 13,689 customers in August, then another 67,000 US customers in September, including records Trezor had been contractually assured were deleted.Trezor's disclosure is worth reading for the tone alone.

Put the four together and the pattern is not cryptography. In none of these cases did anyone break the curve the keys are built on. What failed was an entropy configuration in a firmware build, a logistics provider's database, a marketing site's third-party monitoring tool, and an API credential at Cloudflare. The device in your desk drawer is usually the strongest link in that chain, while the companies around it keep turning out to be the weakest one.

What Keystone owners should do with the device they already own

Devices shipped after 20 October need additional verification, and Keystone is handling those cases through support. Because the check no longer rules out a counterfeit on older units, a few habits are worth changing. Reach the authentication page by typing the address yourself instead of following a link. Compare the code on the device's own screen rather than on a laptop. And treat any inbound call, email or letter about refunds, replacements or display modules as hostile until proven otherwise, which applies to every vendor in this article, not only the two that disclosed this week.

The market shrugged, and that is the point

Bitcoin traded near $80,148 and Ethereum near $2,327 on 27 October, spot bitcoin ETFs took in about $110 million on Monday after a two-day $774 million exit, and the Federal Reserve's rate decision lands the following day. None of that pricing moved because 18,835 wallets were scrapped in a warehouse. Hardware wallet failures cost individuals real money, and the Coldcard losses ran into nine figures, but they do not reprice the asset, because they are operational failures rather than protocol ones.

The uncomfortable detail is the one both companies share. Keystone planned to erase customer records after 180 days, Foundation after 60, and neither system did what the policy said it did. A stolen authentication key can be retired with a new production run. A purge job that quietly stopped running is the kind of failure nobody notices for years, until the database turns up in somebody else's hands.