Keystone to destroy 18,835 compromised hardware wallets after data breach that affected 25,964 customers

Keystone¹ has published a statement today² detailing the October 24 data breach disclosure³, which confirms that private shipping information for at least 25,964 customers was exposed.

The company has apologized for the security incident, temporarily suspended shipping and promised to destroy 18,835 devices that had their authentication key compromised:

This incident has caused concern and inconvenience and has damaged your trust in Keystone. We sincerely apologize. [..] Effective immediately, the customer personal information retention period will be shortened from 180 days to 90 days. [..] The 18,835 devices in existing inventory that contain the old key will be destroyed.

Incident Overview

* [Timeline]
 - October 20: unauthorized access detected
 - October 24: breach publicly disclosed
 - October 26: detailed security report posted
* [Unaffected]
 - devices delivered before October 20 that pass verification
 - payment card or bank details, recovery phrases, private keys, wallet passwords
* [Affected]:
 - devices received after October 20 with old auth key
 - buyer records from 2024-2026 (25,964)
 * [Exposed, real]:
 - names, contact details, shipping addresses, order information
* [Possibly Affected]:
 - unpaid customer checkout records (12,873)
 * [Exposed, real or incomplete/inaccurate]:
 - names, contact details, and shipping information
* [Recommendations]:
 - confirm device is genuine > support@keyst.one
 - follow instructions > keyst.one/authentication
 - ingore/report potential scams:
  - offers for verification, refunds, device returns, asset migration;

According to Keystone, an attacker managed to exploit a vulnerability in a third-party data monitoring tool to escalate privileges and obtain access to personal customer data and to the WebAuth key that was used to verify the authenticity of their hardware devices.

Suspicious communications can be reported through the official reporting channels: the main Keystone website¹ and the associated support email address⁴.

It is worth mentioning that Keystone added support for Monero in 2025, as reported⁵.

Note that currently there are no official instructions for determining if a device key is compromised.

This is an ongoing story and the report will be updated when new information is available.