Keystone, a manufacturer of Bitcoin hardware wallets, announced on Monday that it will destroy 18,835 unsold devices after attackers obtained the permanent factory key used to verify device authenticity. The breach, detected on October 20, also compromised 25,964 buyer records from Keystone’s Shopify store, spanning transactions from 2024 to 2026. These records include names, contact details, shipping addresses, and order information. Keystone stated that recovery phrases and private keys were not involved in the incident and confirmed that devices delivered before October 20 remain unaffected.
The stolen WebAuth key allows attackers to produce counterfeit devices that pass Keystone’s own authentication checks, posing a risk of asset theft if users unknowingly purchase fake hardware. Consequently, Keystone has suspended shipping for all unshipped orders and will switch its website sales to preorders until production resumes with new security keys. The company reported that while 51,083 buyer records were initially identified as potentially affected, 25,119 had already been erased according to policy. However, an automated bulk-deletion tool failed to reliably erase data after the intended 180-day retention period, leaving the remaining 25,964 records exposed.
Keystone acknowledged responsibility for the failure to fulfill its data erasure commitments and has reduced its customer data retention period from 180 days to 90. The company requested Shopify on October 24 to erase all overdue buyer data, expecting completion by November 3. Additionally, Keystone warned customers about potential scams involving "asset migration" or "wallet verification," emphasizing that it will never ask users to return their devices. Reports have been submitted to authorities in the EU, UK, and other jurisdictions.
This incident highlights a critical vulnerability in the supply chain integrity of hardware wallet manufacturers, where the compromise of cryptographic attestation keys can undermine the fundamental trust model of cold storage. Unlike typical data breaches that expose personal information, the theft of the WebAuth key enables the creation of convincing counterfeits that bypass standard verification protocols. This shifts the threat vector from digital phishing to physical supply chain contamination, requiring users to rely on non-cryptographic indicators like packaging or seller reputation, which are easily spoofed.
The operational failure regarding data retention underscores broader compliance risks within the crypto sector, particularly concerning GDPR and similar regulations in the EU and UK. Keystone’s admission that automated deletion tools failed reveals a gap between stated privacy policies and technical execution. As regulators increasingly scrutinize how crypto firms handle user data, such lapses invite stricter oversight and potential penalties. Furthermore, the recurrence of customer list leaks among major vendors like Ledger, Trezor, and SafePal suggests systemic weaknesses in e-commerce integrations, prompting a need for more robust third-party vendor management and independent audit mechanisms for data lifecycle controls.
