Keystone hack: should wallet owners be worried?

The Keystone hack, detected on October 20, 2026, led to a customer data leak and the theft of the WebAuth key used to authenticate devices. The company confirmed the data leak on October 23 and disclosed the key theft on October 26. According to Keystone, seed phrases, private keys, passwords and payment data were not affected.

The implications for owners depend on when they received their device and whether their details were stored in the manufacturer’s online store. Keystone advises that devices received before October 20 can remain in use if they pass authentication. However, exposed addresses and contact details create a risk of fraud, and for devices received on or after October 20, passing authentication is no longer enough to rule out a counterfeit.

Keystone hack: what happened and what is confirmed

Timeline

On October 20, Keystone’s monitoring systems detected unusual activity on its website. The company blocked the attacker’s access that day and subsequently fixed the vulnerability. After reviewing request logs for the application programming interface (API) of Shopify, the platform that powers its online store, Keystone confirmed on October 23 that an unauthorized party had obtained customer data. The first public notice of the leak appeared on October 24, followed on October 26 by a detailed statement on the stolen key and the extent of the incident.

The attacker exploited a vulnerability in a third-party data monitoring tool running on the website and gained elevated access privileges. Keystone has not named the tool or explained where the stolen key was stored. In subsequent replies to users, the company clarified that the attacker obtained the key on October 20, which is why it recommends additional verification for devices received that day or later.

What data was exposed

According to Keystone, the incident involved 51,083 customer records in Shopify. Personal information had already been removed from 25,119 records before the attack, so those anonymized order records no longer contained names, contact details or shipping addresses.

However, 25,964 records from 2024–2026 still contained personal information: names, contact details, shipping addresses and order information, including products and prices. Shopify also held 12,873 abandoned checkout records from users who had entered their details but had not completed payment. Some of that information may have been incomplete or inaccurate, but Keystone plans to notify these users of the risk as well.

Keystone says the leak did not affect payment card data, bank details, identity document numbers, seed phrases, private keys or wallet passwords. The company also said that customer data from purchases through Amazon and other sales channels was not affected.

Why data was kept longer than promised

Keystone had promised to delete shipping addresses 180 days after an order, but its automated bulk deletion tool was unreliable. The company failed to notice that some deletion jobs were returning errors, leaving records from as far back as 2024 in the database when they should already have been removed.

Keystone is now reducing the retention period to 90 days. The company said it submitted requests to Shopify on October 24 to delete customers’ personal information held beyond that period. Keystone expects Shopify to delete the data on November 3, after the mandatory waiting period. It also submitted a separate request to delete abandoned checkout data older than 30 days. Foundation encountered a similar problem with data being retained beyond its stated deadline.

The stolen WebAuth key and device authentication

How the check works

To authenticate a device, you use it to scan the QR code on Keystone’s verification page, then enter the code shown on the wallet’s screen into the website. The open-source firmware code shows that the device decrypts the QR code data using its embedded key and displays a verification code. Because a correct response confirms possession of that key, an attacker with a copy can also pass the check using a counterfeit device.

What the key allows an attacker to do

Keystone says the WebAuth key is used solely for device authentication and plays no role in seed phrase generation, private key derivation or transaction signing. Stealing it does not, by itself, give an attacker access to funds on genuine devices already in use.

With the stolen key, an attacker could manufacture a counterfeit that passes the official check, then sell it or deliver it to a buyer. Keystone has not described a specific method of stealing funds, but such a device could potentially transmit the seed phrase to an attacker or generate a phrase the attacker already knows.

Keystone has not reported any counterfeit devices or thefts of funds linked to this incident.

Why the key cannot be replaced on existing devices

Keystone explains that the key written during manufacturing cannot be erased or overwritten, so it cannot be replaced on devices already produced. Future batches will use a new key, while the company will destroy the 18,835 devices with the old key still in its warehouse. Shipments from its website have been paused until a batch with the new key is produced.

Who is affected

Keystone’s device authentication guidance depends on when you received the device. Its October 26 statement distinguished between devices delivered before and after October 20. In a reply on October 27, the company specifically advised anyone who received a wallet on or after October 20 to contact support. Where you bought it matters for a separate risk: whether the attacker could have obtained your personal details from the manufacturer’s store.

In Ukraine, buyers order Keystone devices both directly from keyst.one and through authorized resellers. The company explicitly stated that the leak from its Shopify store did not affect customer data from purchases through Amazon or other sales channels. This does not change its device guidance, which depends on the delivery date because the key is embedded in the wallet.

Exposed addresses and contact details: risks for buyers

Phishing in Keystone’s name

Knowing your name, address, phone number and purchased products allows a scammer to write a convincing message with accurate order details. Keystone warns of possible offers to refund a purchase, replace a device, “correct” an order or address, or carry out an “asset migration.” Scammers may also demand that a wallet be returned under the pretext of a recall. Keystone is not asking customers to return devices, so such demands should be treated as fraudulent.

Stolen lists can be used for years. The 2020 Ledger database leak exposed the names, addresses and phone numbers of around 272,000 buyers. In 2025 and 2026, users reported receiving letters in the mail with QR codes leading to fake websites that asked for seed phrases. Scammers also targeted Foundation customers with a fake recall: in late October, customers received emails alleging that display modules had been modified.

In Ukraine, this tactic is familiar from calls supposedly coming from a bank’s security department. Using leaked data, scammers could similarly impersonate Keystone by phone, Telegram or Viber. Knowing your name, address and device model makes a message more convincing, but does not establish the sender’s identity. If someone claiming to represent Keystone asks for your seed phrase or demands that you send in your device or move funds, end the conversation and check the information on keyst.one by typing the address yourself.

Our article on crypto phishing and emails from official domains explains how to verify messages from a manufacturer and what to do if you have already shared information with scammers.

Physical security

A hardware wallet’s shipping address can reveal where someone who owns cryptocurrency lives. Order details show which devices a person bought and how much they paid, but do not reveal the value of their crypto holdings. Nevertheless, criminals can use the connection between a name, an address and a wallet purchase to make threats, demand money or plan a physical attack.

CertiK recorded 52 confirmed attacks involving physical coercion in the first half of 2026, often called wrench attacks. That is a third more than in the same period of the previous year. Twenty cases involved home invasions, while 39 of the 52 attacks were recorded in Europe, including 33 in France.

For future purchases, delivery to a pickup point or parcel locker lets you avoid providing your home address, although your name and phone number may still be stored with the order.

Keystone and other hardware wallet incidents in 2026

Other hardware wallet manufacturers have also faced incidents this year. Owners lost funds in the cases involving Ledger devices sold through CryptoBilis and vulnerable Coldcard wallets.

On October 9, Ledger began investigating reports of missing funds from users in Southeast Asia. On October 10, it confirmed a third-party hardware implant in one affected user’s device. On October 13, the Ledger Donjon team explained that the added circuit reads the seed phrase from the screen during setup and sends it over a mobile network. Ledger said the implant does not modify the secure chip or operating system, and that it had found no evidence of a breach of its own infrastructure.

Every loss of funds that Ledger confirmed as part of this incident involved a device from the reseller CryptoBilis. Early loss estimates exceeded $86 million, while Bitquery’s updated investigation on October 16 reported $102 million from 335 wallets. This is the analysts’ estimate; Ledger has not confirmed a total loss figure.

On July 30, Coldcard manufacturer Coinkite published a warning about a seed phrase generator flaw in vulnerable firmware versions. Attackers could reproduce the corresponding private keys and steal funds without access to the device. For Mk2 and Mk3, versions 4.0.1–4.1.9 are vulnerable. In its updated warning, Coinkite also lists affected versions for Mk4, Mk5 and Q, along with the fixed firmware releases for each model. Updating the firmware does not fix a previously generated seed phrase, so the manufacturer provides separate fund migration guidance for those wallets. We cover the cause of the vulnerability and the steps owners need to take in our article on the Coldcard hack.

Galaxy Research reported on August 14 that losses it considered confirmed with high confidence totaled 1,778.84 BTC, or about $112.7 million at the exchange rate used at the time. The $153 million estimate also included possible thefts that the researchers had not yet confirmed.

Trezor experienced leaks through its logistics provider ShipMonk and email service provider Brevo. Trezor’s updated figures put the first incident at 80,689 affected customers; the second allowed phishing emails to be sent and the subscriber email list to be copied. The Brevo incident also affected BitBox. In January, Ledger reported an order data leak at Global-e, a partner that handled some international purchases on Ledger.com. According to Ledger, payment data was not affected in that incident.

In late October, Foundation reported compromised Cloudflare API keys and a vulnerability in a self-hosted application, after which phishing emails were sent in its name. A subsequent investigation found that copies of orders had remained in old tables following a database migration, despite a process configured to remove personal information 60 days after shipment. The company also found records that were not covered by automatic cleanup at all.

The Keystone hack caused a customer data leak and introduced the risk of counterfeits in the supply chain. The first issue has parallels with the Trezor and Foundation incidents, while the second has parallels with the Ledger case. Keystone has not, however, reported any loss of funds resulting from its incident.

What to do now

If you received your device on or after October 20

• Do not initialize the device or send funds to a wallet created on it.
• Contact Keystone support at [email protected] and save the result of the online authentication check.
• Start using the device only after support confirms it is genuine.

Keystone has not issued separate instructions for users who have already created a wallet and received funds on a device whose authenticity has not yet been confirmed. We recommend generating a new seed phrase on a device you know is genuine and transferring funds to the new wallet’s addresses. This could be a Keystone received before October 20 and verified according to the manufacturer’s guidance, or a genuine device from another brand. Treat the old seed phrase as potentially compromised: restoring the same phrase on another device does not remove the risk. Ledger gave similar advice to CryptoBilis customers, recommending a move to a new seed phrase.

If you are choosing a device from another manufacturer for your new wallet, we carry the Trezor Safe 7 and Ledger Flex. Check support for the coins and apps you need before deciding. Our Trezor Safe 7 and Ledger Flex comparison covers their differences in security, backups and multisig use.

If your personal data may have been stolen

Keystone promises to notify affected users individually, but not receiving an email does not confirm that your data is safe. The company has also announced a page where users will be able to check, without specifying a launch date.

• For future hardware wallet orders, use a separate email address and, where possible, a separate phone number.
• Do not disclose the value of your holdings or discuss it in public forums.
• If you receive SMS login codes for your exchange or email account on the number listed in your order, switch to an authenticator app or a hardware security key, depending on what the service supports. Knowing your number could help scammers attempt a SIM swap to intercept your messages.
• Treat requests involving compensation, replacements, device recalls or “asset migration” as fraudulent, even if the sender correctly describes your order. Verify such messages through keyst.one by typing the address yourself.

If you hold substantial funds

If access to all your funds depends on one seed phrase, a counterfeit device or a firmware flaw could put all your holdings at risk.

An additional passphrase, often called the “25th word,” creates a separate wallet that requires both the seed phrase and the same passphrase for recovery. Store them separately, because the seed phrase alone cannot restore access to that wallet without the passphrase. If you enter it on a counterfeit device, however, an attacker could potentially capture both your seed phrase and passphrase.

For Bitcoin, a 2-of-3 multisig setup using devices from different manufacturers reduces reliance on a single device: a transaction requires signatures from two of three independent keys. Compromising one key is not enough to move funds, but you must save backups and the multisig wallet configuration in advance. For future orders, consider delivery to a pickup point, parcel locker or trusted person to avoid linking your home address to a hardware wallet purchase.

If you are planning a purchase

In its October 26 statement, Keystone announced a move to preorders and a pause on shipments of devices with the old key. If you plan to buy a Keystone 3 Pro, ask the manufacturer or authorized reseller for written confirmation that the device comes from a batch with the new key.

Check that packaging seals are intact, authenticate the device and initialize it yourself. Do not use a prewritten seed phrase supplied in the box. A counterfeit can imitate the results of checks carried out by the device itself, including a firmware checksum check, so combine these steps with verification of the seller and the device’s origin.

Keystone hack: what it means for wallet owners

Owners of devices received before October 20 do not need to move funds solely because of this incident: the WebAuth key is unrelated to the seed phrase, and Keystone considers those devices genuine if they pass authentication. Anyone who received a wallet on or after October 20 should contact support before using it. Before a new purchase, confirm which key the device contains.

For buyers whose contact details and addresses were stored in the manufacturer’s store, phishing remains a risk even after the vulnerability has been fixed. Knowing your order details does not establish a sender’s identity: verify messages through official channels and do not disclose your seed phrase under the pretext of a check, replacement or recall.