Keystone update: breach exposed 25,964 buyer records and a device-authentication key — 18,835 unsold wallets to be destroyed
Keystone said on October 26, 2026 that its website breach exposed 25,964 buyer records and the WebAuth key used to verify its devices, that it will destroy 18,835 unsold devices and suspend shipments, and that devices received after October 20 with the old key need extra checks.
What happened
We first flagged this on October 24, 2026 — here’s what changed. Update Oct 27, 2026, 08:57 ET: Added the confirmed record counts (25,964 buyer records, plus 12,873 unpaid checkout records that may have been affected), the third-party monitoring-tool flaw as the entry point, the stolen device-authentication key, the destruction of 18,835 unsold devices and the suspension of shipments, the extra verification step for devices received after October 20, and the failure of the 180-day data-deletion tool. In a more detailed update posted on Monday, October 26, Keystone said the attacker gained access to its website on October 20 through a vulnerability in a third-party data monitoring tool used on the site, which allowed privilege escalation. In addition to customer information, the attacker obtained the WebAuth key Keystone uses to verify whether a device is genuine through its online authentication page. That key is written into devices during manufacturing and cannot be erased or rewritten, so Keystone said it will destroy the 18,835 unsold devices in existing inventory that contain the old key and will not sell or ship them, and it has suspended shipments. New devices will carry a replacement authentication key, website sales will shift to preorders, and customer data retention will be cut to 90 days.
Who is affected
The update puts numbers on the original disclosure. Keystone said the incident involved 25,964 buyer records that still contained personal information — names, contact details, shipping addresses and order details — covering purchases from 2024 through 2026 through its official Shopify store, out of 51,083 total Shopify buyer records; the personal information in more than 25,000 of those records had already been erased or anonymised before the access. Another 12,873 unpaid checkout records containing names, contact details and shipping information were also identified, and CoinDesk reports those may have been affected. Some of the records should not have been there at all: Keystone acknowledged that its promised 180-day deletion was not fully enforced because its automated bulk-erasure tool did not operate reliably and some deletion tasks failed without the company detecting it. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company wrote. Keystone repeated that the breach did not expose recovery phrases, private keys or wallet credentials.
How serious
There are now two distinct risks. The first is the one in the original report: the stolen names, addresses and order records are exactly what a scammer needs to pose as Keystone support offering a refund, a replacement or a fix, in order to chase a recovery phrase — and Keystone again warns against fake recall or asset-migration messages, and says users do not need to move funds because of the breach alone. The second risk is new, and it is about the devices themselves: because the stolen key is the one Keystone’s authentication page uses to tell a genuine device from a fake, a counterfeit wallet built with that key could pass the online authenticity check. Keystone draws the line by delivery date: devices delivered before October 20 can still be verified as genuine through the normal process, but for a device received after October 20 that uses the old key, the company says it cannot completely rule out that the device is counterfeit even if it passes the online check.
What to do now
If you received a Keystone device after October 20, 2026, contact Keystone support for the additional verification the company directs those customers to seek before relying on the device — and reach support through the company’s official site, which you open yourself, not through a message that arrives about the breach. If your device was delivered before October 20, Keystone says it can still be verified as genuine through the normal authentication process. For every customer in the record counts above, keep treating unexpected contact about refunds, replacements, recalls or moving assets as unproven, and never disclose a recovery phrase: it was not taken in this breach, and no refund, replacement or verification step requires it.
Sources: CoinDesk · Gizmodo · Original report: Keystone breach (October 24, 2026)