Keystone to destroy 19,000 wallets after website security breach

Keystone security breach — Hardware wallet manufacturer Keystone is destroying nearly 19,000 unsold devices and halting shipments following a major security breach of its website that exposed customer data and a critical authentication key.

The company announced that an attacker gained unauthorized access to its website on October 20 through a vulnerability in a third-party data monitoring tool. The breach exposed 25,964 customer purchase records, some of which were retained beyond Keystone’s stated 180-day data deletion policy due to a failure of an automated tool.

More critically, the incident compromised a private key used to sign firmware updates. This key could potentially allow counterfeit devices to pass the company’s authenticity checks, posing a significant security risk to users.

In response, Keystone stated it will physically destroy 18,835 unsold hardware wallets from its inventory. The company is also urging customers to only download firmware updates directly from its official website and to verify the authenticity of their devices using the provided security seals.