TL;DR:
- An intrusion detected on October 20, 2026, exposed the personal information of 25,964 buyers and 12,873 incomplete purchase records.
- The attacker obtained the WebAuth authentication key used to validate device authenticity on the firm’s portal.
- The company will destroy 18,835 units in inventory and suspend direct shipments to replace the key at the factory level.
Cold wallet manufacturer Keystone confirmed this Monday that a security flaw exposed customer records and a device authentication key following an intrusion into its official Shopify store.
— Keystone Hardware Wallet (@KeystoneWallet) October 26, 2026
A cyberattacker exploited a critical vulnerability in a third-party data monitoring tool to gain elevated privileges within the company’s web systems. The hacker gained access on October 20, prompting the disconnection of vulnerable web modules and the blocking of external access. According to a market report, the company formalized the details of the compromise through a technical statement released during the day on Monday, October 26.
Official information indicates that the incident involved a total of 51,083 transaction records generated in its online store. Of that total, 25,964 entries contained personal data such as names, contact numbers, email addresses, physical shipping addresses, and purchase details made between 2024 and 2026.
The remaining 25,119 records had already been anonymized by the storage system prior to the event. The leak also included 12,873 incomplete checkout attempts where users entered preliminary contact details.
Keystone acknowledged that the improper retention of these records was caused by a failure in its automated periodic cleanup tool. The firm maintained a policy requiring data deletion after 180 days, but multiple failed purge tasks went undetected by the engineering team.
Impact on the WebAuth Key and Hardware Counterfeiting Risks
The most sensitive technical aspect of the breach involves the devices’ WebAuth authentication key. This cryptographic component is burned into the hardware’s integrated circuit during the factory assembly phase and does not allow code rewriting.
The compromised key is solely responsible for certifying to the website that the product is genuine. Keystone clarified that the stolen component does not participate in private key derivation, does not generate recovery phrases, and is not involved in transaction signing.
However, the manufacturer admitted that malicious actors in possession of this key could potentially produce cloned devices capable of passing authenticity verifications on its portal. As of the publication of the technical report, the company has not detected counterfeit units circulating in the market.
As a physical mitigation measure, Keystone management announced the total destruction of 18,835 stored warehouse wallets containing the compromised key. Pending order shipments on the official website remain suspended while production adapts to a new cryptographic key. Incoming orders will operate under a temporary presale model until hardware modifications are finalized.
For users with devices received before October 20, 2026, the company stated that the units were assembled earlier and maintain their internal security intact. For deliveries after that date, buyers were urged to validate their serial numbers directly with customer support.
Security experts warned that leaks of physical buyer addresses represent direct real-world threat vectors. Data from analytics firm CertiK presented by industry executives recorded 52 direct physical attacks against cryptocurrency holders during the first half of 2026—a 33% year-over-year increase compared to 2025. Given this scenario, the company warned against social engineering campaigns that could leverage spoofed identities to offer product replacements or hardware collection under alleged recall notices.
On an operational level, Keystone reduced its commercial data retention period from 180 to 90 days. On October 24, 2026, the company submitted formal requests to Shopify to execute the purge of remaining data—a process set to conclude on November 3 once the platform’s processing periods are fulfilled.
