- Trending
- Comments
- Latest
Keystone will destroy 18,835 unsold hardware wallets and suspend shipments after attackers breached its website on October 20 and exposed an authentication key that is embedded in every device and cannot be changed, the company said on October 26.
The key lets devices pass online authenticity checks, which creates a risk that counterfeits could pass as genuine. The breach also exposed 25,964 customer records, though Keystone says no recovery phrases or private keys were affected.
The Keystone incident is significant because the compromised key was embedded in devices during manufacturing and could not be changed.
According to the company’s disclosure, the key enabled devices to pass online authenticity checks, creating a risk that counterfeit products could potentially be presented as genuine.
A hardware wallet is designed to help users safeguard their cryptocurrency by keeping private keys isolated from internet-connected environments.
However, this protection depends on the integrity of the device, its manufacturing process and the procedures used to verify that it has not been tampered with.
If counterfeit devices can pass authenticity checks, customers may have difficulty distinguishing legitimate products from potentially compromised alternatives.
Keystone responded by announcing plans to destroy 18,835 unsold units and replace the affected authentication key in newly manufactured devices.
The company also indicated that it would move website sales to a preorder model while addressing the incident.
Beyond the authentication issue, the breach revealed shortcomings in Keystone’s handling of customer information.
The company maintained a 180-day data retention policy, meaning records should have been deleted after the specified period. However, an automated deletion tool failed without the company detecting the problem.
Keystone acknowledged the lapse in a statement included in its disclosure. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company wrote.
The admission shows a data governance problem that can affect cryptocurrency businesses even when their core wallet technology remains uncompromised.
Customer databases may contain information that can be useful to criminals attempting phishing campaigns, impersonation scams or targeted attacks against digital asset holders.
Keystone said it would reduce its customer data retention period from 180 days to 90 days. The revised approach is intended to limit how long customer information remains stored, although its effectiveness will depend on implementation and monitoring.
Investors considering a hardware wallet should therefore review how a provider handles personal information, not just how it stores cryptographic keys.
Strong access controls, effective deletion procedures and transparent incident reporting are important elements of a broader security framework.
Keystone’s breach comes amid other security incidents involving cryptocurrency wallet companies, suggesting that threats can emerge at different points in the digital asset custody process.
A separate incident involving Ledger reportedly involved compromised devices distributed through resellers in Southeast Asia. Hidden components were used to capture users’ recovery phrases during wallet setup, according to the report.
This type of attack illustrates how risks can arise between manufacturing, distribution and the final customer.
Another incident involving Coldcard concerned a flaw in seed-generation software that reportedly enabled attackers to reconstruct private keys and drain wallets remotely.
Unlike a database breach, such a vulnerability can undermine the cryptographic safeguards users expect from their wallet technology.
Meanwhile, Foundation disclosed a separate phishing-related incident involving messages that appeared to originate from its official domains.
The company identified more than 23,000 phishing email attempts and reported no evidence that its Passport devices or private keys had been compromised.
Foundation also discovered older database copies that had not been removed under its 60-day deletion process.
The company said the records included approximately 5,600 mailing addresses and 5,200 phone numbers, although it could not establish how many had actually been accessed.
Taken together, these incidents show that cryptocurrency security requires several layers of protection.
A hardware wallet may protect private keys from many online threats, but it cannot independently prevent every form of social engineering, compromised manufacturing or customer-data exposure.
Keystone said devices delivered before October 20 remain safe to use if they pass the company’s authentication checks.
Customers who received devices using the old authentication key after that date were advised to seek additional verification before using them.
The company also stated that users did not need to move their cryptocurrency solely because of this breach. It warned customers to be cautious about fraudulent recall notices or messages asking them to transfer their assets.
Crypto investors should rely on verified announcements from the manufacturer and avoid clicking links in unsolicited emails, direct messages or social media posts claiming that immediate action is required.
Anyone uncertain about a device’s authenticity should contact the company through independently verified official channels.
Investors should also remember that a recovery phrase is effectively a master key to the assets associated with a wallet.
It should never be shared with customer support representatives, entered into an unverified website or supplied in response to an unexpected security request.
The Keystone incident does not mean that every hardware wallet is unsafe. Instead, it demonstrates that self-custody depends on more than purchasing a device and storing cryptocurrency offline.
Manufacturers must maintain secure systems, protect customer information and establish reliable methods for verifying products.
The central lesson is to treat wallet security as an ongoing process. Evaluating the manufacturer’s track record, purchasing devices through trusted channels, keeping recovery phrases private and verifying security notices can reduce exposure to avoidable risks.
As Keystone works to replace its authentication key and improve its data retention practices, the incident is likely to reinforce scrutiny of security standards across the hardware wallet industry.
Trust in cryptocurrency custody products ultimately depends on whether providers can demonstrate that both their technology and their operational procedures are designed to protect users.
Copyright © 2025 - The Bit Gazette.
