Keystone has expanded its account of a recent website breach, saying the attacker also obtained a device authentication key used to confirm that its hardware wallets are genuine. The new disclosure broadens an incident the company had initially described as a customer data leak.

The company said the compromised key could make it possible for counterfeit wallets to pass Keystone’s authenticity checks. If such devices were sold or shipped as legitimate products, customers could unknowingly use them, creating a risk of asset theft.

Breach moved beyond customer data

According to Keystone, the attacker exploited a vulnerability in a third-party monitoring tool connected to its website. That access was then used to escalate privileges, which allowed the attacker to obtain both customer information and the authentication key tied to device verification.

The stolen key is significant because it is part of the process used to validate that a wallet is an authentic Keystone product. In practical terms, the company said, a fake device carrying the right verification credentials could be mistaken for a genuine one.

Inventory affected and shipments paused

Keystone said it will destroy 18,835 devices in its inventory that contain the compromised key. It has also halted production shipments of all devices using that key while it replaces the authentication system.

The company said shipments will resume only after a new authentication key is in place. Until then, the disclosure indicates a precautionary pause aimed at preventing additional devices linked to the compromised key from reaching customers.

Which devices are considered safe

Keystone said devices manufactured and delivered before Oct. 20 should be considered safe. For devices delivered after that date, however, the company said their authenticity cannot be guaranteed.

Customers who may have received affected units were urged to contact Keystone support for verification. The company did not say in the report how many shipped devices may be affected, but it drew a clear line between products delivered before Oct. 20 and those delivered later.

Customer records were also stolen

Alongside the device-related disclosure, Keystone said 25,964 buyer records from 2024 to 2026 were taken in the breach. It also said its Shopify store had generated 51,083 records in total, of which 25,119 had already been deleted under the company’s data retention policy.

In addition, 12,873 customer checkout records kept by Shopify were stolen. Keystone said those records related to purchases that were not completed.

Next confirmed step

For now, the company’s confirmed response is to replace the compromised authentication key, destroy devices in inventory that carry it, and keep related shipments suspended until the new key is active.

The incident also adds Keystone to a growing list of hardware wallet makers hit by breaches this year, underlining that website compromises can extend beyond personal data and affect the integrity checks used for physical security products.

Source: cointelegraph.com