An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.

Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve owners' recovery phrases or wallet private keys.

Keystone will destroy 18,835 unsold devices that carry the key, and all new devices will get a new one.

Keystone found the unauthorized access on October 20, and its advice to owners depends on when a device arrived. For a device received after that date with the old key, the company said: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit."

Owners of such a device should contact Keystone support and use it only after the company confirms it is genuine.

A device delivered before October 20 that passes the check can be considered genuine and used normally, according to Keystone. The company has not said when the attacker first got in.

The attacker exploited a vulnerability in a third-party data monitoring tool used by Keystone's website to escalate privileges, according to the company. That let the attacker obtain customer data and the key.

Keystone blocked the attacker's access on October 20 and has since fixed the vulnerability. It has not said where the key was stored.

The owner scans a QR code on Keystone's verification page with the device, then enters the code the device displays on the page.

Source link