Hardware wallet maker Keystone acknowledged on October 26, 2026, that the breach of its website went beyond a customer data leak. The attacker also obtained the WebAuth key – the digital credential embedded into Keystone devices during manufacturing and used for the online authenticity check.
How the Keystone breach unfolded
Keystone detected suspicious access to its website on October 20, 2026. The attacker exploited a vulnerability in a third-party monitoring tool embedded in the site and escalated privileges to the required level. The company cut the attacker’s access the same day and patched the vulnerability.
The first public statement went out only on October 24 – at that point Keystone reported the theft of customer contact details and shipping addresses. Two days later, on October 26, it announced a far more serious loss – the WebAuth device authentication key.
The customer data walked out because of Keystone’s own procedural failure. The company’s Shopify store held 51,083 buyer records. Under its 180-day retention policy, 25,119 of them should have been deleted – and they were. The remaining 25,964 records, dating from 2024 to 2026, fell within the attacker’s reach: the automated bulk erasure tool ran unreliably, some operations stalled, and Keystone failed to catch it in time.
In parallel, the attacker may have had access to 12,873 Shopify checkout records – data from unfinished purchases. Keystone has already asked Shopify to delete checkout records retained beyond 30 days.
The counterfeit threat: what it means for Keystone owners
The WebAuth key is not just a password. It is embedded in a device during manufacturing and cannot be replaced afterwards. Which means the 18,835 devices in Keystone’s inventory carrying the leaked key cannot be made safe anymore – they will be destroyed. Shipments through the site are suspended, and the company is moving to a preorder model.
For buyers, the picture splits around the date of October 20. Devices delivered before that date are safe – their authenticity check still deserves trust. Devices delivered after October 20 are in question: even if such a device passes the check, Keystone cannot guarantee that it is not a counterfeit. These owners have been asked to contact support for additional verification before using the device.
Production of new devices with a different authentication key is already underway. Shipments will resume only once those devices are ready. Keystone is cutting its customer data retention from 180 to 90 days.
Private keys, seed phrases, wallet passwords, banking information and document numbers were not caught up in the incident. Passport devices (Keystone’s second product line) were not affected. The company has not yet recorded any affected buyers or cases of stolen cryptocurrency connected to the incident.
Keystone in the string of hardware wallet incidents of 2026
The Keystone breach became the fourth major incident in the hardware wallet industry over the past four months. Each attack has its own nature, but the vector is shared – the supply chain and the infrastructure around the devices.
In July 2026, Coldcard manufacturer Coinkite warned users of a firmware exploit – devices generated seed phrases with reduced entropy, and attackers used it to drain millions of dollars. In August, Trezor disclosed a breach at its shipping partner ShipMonk; the initial number of affected customers was 14,000, and by September it had grown to 80,000. The same August, SafePal reported a compromise of its order-tracking plug-in – the leak hit around 40,000 buyers. In October, Ledger asked resellers in Southeast Asia and Hong Kong to pause sales after reports that devices sold in the region contained unauthorized implants capable of intercepting seed phrases.
