Short answer
Keystone says an attacker exploited a flaw in a third-party monitoring tool on its website and took customer records and the authentication key written into its wallets. Keystone says recovery phrases and private keys were not reached and will destroy 18,835 unsold devices.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Keystone |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Crypto hardware wallets |
| Country | Not stated |
| Detected | 2026-10-20 |
| Disclosed | 2026-10-24 |
| People or records affected | 25,964 buyer records (2024 to 2026) plus 12,873 unpaid checkout records; 18,835 unsold devices carry the exposed key |
What data was exposed
- Names, contact details, shipping addresses and order details of website buyers
- 12,873 unpaid checkout records, included as a precaution
- The key Keystone devices use to prove they are genuine on its verification page
What happened
Keystone, a maker of hardware wallets for cryptocurrency, said an attacker got into its website on 20 October 2026. CoinDesk reports the way in was a flaw in a third-party data monitoring tool. Keystone found and blocked the access that day and says it has fixed the vulnerability. It first disclosed a customer data problem on 24 October and published a fuller statement on 26 October, which CoinDesk and The Hacker News reported on 27 October. The statement was posted on X, and we could not open it directly, so the details below rest on those two outlets.
The articles do not say when the attacker first got in.
What was taken
Two kinds of data were involved.
Customer records: 25,964 buyer records from website purchases between 2024 and 2026, plus 12,873 unpaid checkout records included as a precaution. They hold names, contact details, shipping addresses and order details. The Hacker News reports Keystone said payment card data, bank details and government ID numbers were not involved. Amazon and other sales channels were not affected, and the store runs on Shopify.
The authentication key: Keystone devices carry a key written at the factory that lets a verification page on its website confirm the hardware is genuine. The owner scans a QR code with the device and enters the code it shows. Anyone holding the key could produce valid codes, so a counterfeit carrying it could pass the check. Keystone says the key plays no role in making recovery phrases, deriving private keys or signing transactions, and it has received no reports of counterfeit devices or thefts.
The deletion failure
Keystone promised to erase customer data after 180 days. It said a bulk-deletion tool failed to remove some records reliably and the failures went unnoticed. In its words, as quoted by CoinDesk: “We failed to fulfill our commitment to erase customer data on time.” Retention is now 90 days.
Keystone’s response
- It will destroy 18,835 unsold devices that carry the old key. New devices will get a new key.
- Shipping of unshipped website orders is paused, and website sales move to preorder.
- It is emailing affected customers and plans a page to check whether your data was involved.
What owners should know
Because the key cannot be changed on devices already made, Keystone gives different guidance by delivery date. Delivered before 20 October and passing the check: use normally. Received after 20 October with the old key: do not use until support confirms it is genuine. Keystone adds that even a passing device cannot be fully ruled out as counterfeit. The Hacker News notes the verification page gave no instructions for identifying which key a device carries as of 27 October.
Keystone says holders do not need to move funds because of the incident alone, and warns against fake recall or asset migration messages.
Related reading
Fake wallet notices are a common drain tactic. See our guide to crypto wallet drainer and fake airdrop scams, the data breach checklist and tampered wallets sold through a Southeast Asian reseller.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'recall', 'asset migration' or 'verify your device' emails and texts that ask for your recovery phrase.
- Counterfeit wallets that could pass Keystone's online authenticity check because the key was exposed.
- Shipping-themed phishing aimed at buyers whose names and addresses were in the stolen records.
What to do if you are affected
- 01Never type your recovery phrase into a website, email, chat or any device you did not set up yourself.
- 02If you received a Keystone after 20 October 2026, contact Keystone support before use, even if it passes the online check.
- 03If you bought before 20 October and your device passes the check, Keystone says you can keep using it, and it says you do not need to move funds because of this incident alone.
- 04Ignore any message asking you to return a device. Keystone says it will not ask for that.
- 05Type keyst.one into your browser yourself instead of following links in messages.
Frequently asked questions
Did the attacker get my recovery phrase or private keys?
Keystone says recovery phrases, private keys and wallet credentials were not exposed. The stolen key is used only to check that a device is genuine.
Why is Keystone destroying 18,835 devices?
The authentication key is written during manufacturing and cannot be changed, so unsold units that carry the exposed key will not be sold. New devices get a new key.
Is my Keystone safe to use?
Keystone says devices delivered before 20 October that pass its check can be used normally. For devices received after 20 October with the old key, it says to confirm with support first, because a passing check cannot fully rule out a counterfeit.
Why were old customer records still there?
Keystone said an automated deletion tool failed and it did not catch the failure in time, so some records outlived its 180-day retention promise. It has cut retention to 90 days.
Sources
- Crypto wallet maker Keystone is destroying nearly 19,000 devices after a major security breach, CoinDesk, 2026-10-27
- Keystone to destroy 18,835 hardware wallets after authentication key theft, The Hacker News, 2026-10-27
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.