Keystone Hardware Wallet Breach Exposes Authentication Key and 25964 Customer Records

Attackers breached Keystone’s systems through a third-party monitoring vulnerability, exfiltrating 25,964 customer records and stealing the permanent WebAuth key used to verify device authenticity.

• Physical security is now in question: The stolen cryptographic key enables unauthorized actors to manufacture counterfeit devices that successfully pass authenticity checks, opening vectors for direct asset theft if new units are compromised.
• Customer identities are circulating: The incident leaked 25,964 buyer shipping records and names spanning 2024 to 2026, alongside 12,873 abandoned checkout profiles, heightening physical and digital targeted phishing risks for crypto holders.
• The vendor response is aggressive: Keystone suspended shipments, committed to destroying all affected inventory, shortened operational data retention from 180 to 90 days, and confirmed that units received before October 20 remain safe.

Expect hardware custody providers to shift toward revocable authentication models and minimal customer data retention as physical supply chain vulnerabilities mount.