{"id":76238,"date":"2026-10-29T16:51:36","date_gmt":"2026-10-29T14:51:36","guid":{"rendered":"https:\/\/lwallet.com.ua\/?p=76238"},"modified":"2026-10-29T16:51:36","modified_gmt":"2026-10-29T14:51:36","slug":"keystone-cyberattack","status":"publish","type":"post","link":"https:\/\/lwallet.com.ua\/en\/keystone-cyberattack\/","title":{"rendered":"Keystone hack: should wallet owners be worried?"},"content":{"rendered":"\r\n\r\n\r\n

The Keystone hack<\/strong>, detected on October 20, 2026, led to a customer data leak and the theft of the WebAuth key used to authenticate devices. The company confirmed the data leak on October 23 and disclosed the key theft on October 26. According to Keystone, seed phrases, private keys, passwords and payment data were not affected.<\/p>\r\n\r\n\r\n\r\n

The implications for owners depend on when they received their device and whether their details were stored in the manufacturer’s online store. Keystone advises that devices received before October 20 can remain in use if they pass authentication. However, exposed addresses and contact details create a risk of fraud<\/strong>, and for devices received on or after October 20, passing authentication is no longer enough to rule out a counterfeit<\/strong>.<\/p>\r\n\r\n\r\n\r\n

Keystone hack: what happened and what is confirmed<\/h2>\r\n\r\n\r\n\r\n

Timeline<\/h3>\r\n\r\n\r\n\r\n

On October 20, Keystone’s monitoring systems detected unusual activity on its website. The company blocked the attacker’s access that day and subsequently fixed the vulnerability. After reviewing request logs for the application programming interface (API) of Shopify, the platform that powers its online store, Keystone confirmed on October 23 that an unauthorized party had obtained customer data. The first public notice of the leak appeared on October 24, followed on October 26 by a detailed statement on the stolen key and the extent of the incident<\/a><\/strong>.<\/p>\r\n\r\n\r\n\r\n

The attacker exploited a vulnerability in a third-party data monitoring tool running on the website and gained elevated access privileges. Keystone has not named the tool or explained where the stolen key was stored. In subsequent replies to users, the company clarified that the attacker obtained the key on October 20<\/strong>, which is why it recommends additional verification for devices received that day or later.<\/p>\r\n\r\n\r\n\r\n

What data was exposed<\/h3>\r\n\r\n\r\n
\r\n
\"Keystone<\/figure>\r\n<\/div>\r\n\r\n\r\n

According to Keystone, the incident involved 51,083 customer records in Shopify. Personal information had already been removed from 25,119 records before the attack<\/strong>, so those anonymized order records no longer contained names, contact details or shipping addresses.<\/p>\r\n\r\n\r\n\r\n

However, 25,964 records from 2024\u20132026<\/strong> still contained personal information: names, contact details, shipping addresses and order information, including products and prices. Shopify also held 12,873 abandoned checkout records<\/strong> from users who had entered their details but had not completed payment. Some of that information may have been incomplete or inaccurate, but Keystone plans to notify these users of the risk as well.<\/p>\r\n\r\n\r\n\r\n

Keystone says the leak did not affect payment card data, bank details, identity document numbers, seed phrases, private keys or wallet passwords. The company also said that customer data from purchases through Amazon and other sales channels was not affected.<\/p>\r\n\r\n\r\n\r\n

Why data was kept longer than promised<\/h3>\r\n\r\n\r\n\r\n

Keystone had promised to delete shipping addresses 180 days after an order, but its automated bulk deletion tool was unreliable. The company failed to notice that some deletion jobs were returning errors, leaving records from as far back as 2024 in the database when they should already have been removed.<\/p>\r\n\r\n\r\n\r\n

Keystone is now reducing the retention period to 90 days<\/strong>. The company said it submitted requests to Shopify on October 24 to delete customers’ personal information held beyond that period. Keystone expects Shopify to delete the data on November 3<\/strong>, after the mandatory waiting period. It also submitted a separate request to delete abandoned checkout data older than 30 days. Foundation encountered a similar problem with data being retained beyond its stated deadline.<\/p>\r\n\r\n\r\n\r\n

The stolen WebAuth key and device authentication<\/h2>\r\n\r\n\r\n
\r\n
\"A<\/figure>\r\n<\/div>\r\n\r\n\r\n

How the check works<\/h3>\r\n\r\n\r\n\r\n

To authenticate a device, you use it to scan the QR code on Keystone’s verification page<\/a>, then enter the code shown on the wallet’s screen into the website. The open-source firmware code<\/a> shows that the device decrypts the QR code data using its embedded key and displays a verification code. Because a correct response confirms possession of that key, an attacker with a copy can also pass the check using a counterfeit device.<\/strong><\/p>\r\n\r\n\r\n\r\n

What the key allows an attacker to do<\/h3>\r\n\r\n\r\n\r\n

Keystone says the WebAuth key is used solely for device authentication and plays no role in seed phrase generation, private key derivation or transaction signing<\/strong>. Stealing it does not, by itself, give an attacker access to funds on genuine devices already in use.<\/p>\r\n\r\n\r\n\r\n

With the stolen key, an attacker could manufacture a counterfeit that passes the official check, then sell it or deliver it to a buyer. Keystone has not described a specific method of stealing funds, but such a device could potentially transmit the seed phrase to an attacker or generate a phrase the attacker already knows.<\/p>\r\n\r\n\r\n\r\n

Keystone has not reported any counterfeit devices or thefts of funds linked to this incident.<\/p>\r\n\r\n\r\n\r\n

[vc_message color=”info” message_box_style=”classic” message_box_color=”alert-info” style=”rounded”]The WebAuth key and the firmware signing key are separate keys.<\/strong> In replies to users, Keystone specifically stated that the incident did not affect its firmware signing key.[\/vc_message]<\/p>\r\n\r\n\r\n\r\n

Why the key cannot be replaced on existing devices<\/h3>\r\n\r\n\r\n\r\n

Keystone explains that the key written during manufacturing cannot be erased or overwritten, so it cannot be replaced on devices already produced. Future batches will use a new key, while the company will destroy the 18,835 devices with the old key still in its warehouse<\/strong>. Shipments from its website have been paused until a batch with the new key is produced.<\/p>\r\n\r\n\r\n\r\n

Who is affected<\/h2>\r\n\r\n\r\n
\r\n
\"Pause<\/figure>\r\n<\/div>\r\n\r\n\r\n

Keystone’s device authentication guidance depends on when you received the device<\/strong>. Its October 26 statement distinguished between devices delivered before and after October 20. In a reply on October 27, the company specifically advised anyone who received a wallet on or after October 20<\/strong> to contact support. Where you bought it matters for a separate risk: whether the attacker could have obtained your personal details from the manufacturer’s store.<\/p>\r\n\r\n\r\n\r\n