Hardware wallet maker Keystone said it will destroy almost 19,000 unsold devices and suspend shipments after a website breach exposed customer information and a key that could let counterfeit wallets pass authenticity checks.

An attacker gained access to the company’s website on Oct. 20 through a flaw in a third-party data monitoring tool, Keystone said Monday in a post on X. The attack exposed 25,964 buyer records from 2024 through 2026, including names, contact details, shipping addresses and order information. Another 12,873 unpaid checkout records may have been affected.

The breach adds to a string of attacks on hardware wallet users this year. At Ledger, criminals fitted devices sold through resellers in Southeast Asia, with hidden components capturing recovery phrases during setup. Similarly, a flaw in Coldcard’s seed-generation software let attackers reconstruct private keys and drain wallets remotely.

The stolen Keystone key is built into devices during production and cannot be changed. It allows wallets to pass online authenticity checks, raising the risk that fake devices could appear genuine and put users' funds at risk, according to the firm. The company said it will destroy 18,835 unsold units.

Keystone said the breach did not expose recovery phrases, private keys or wallet credentials.

Some customer records should have been deleted under Keystone's 180-day retention policy, but an automated deletion tool failed without the company detecting the issue, it said.

“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” Keystone wrote.

Source link