Fake ID card. Keystone revealed on October 24, 2026 that an intruder accessed its official website and obtained customer data. In a second press release, published on October 26, 2026, the company adds a more embarrassing detail: the key which proves the authenticity of its wallets is among the elements recovered.
The key points of this article:
The stolen WebAuth key is used to verify that a Keystone is authentic on the official website.
25,964 purchase records and 12,873 abandoned shopping carts contain names, addresses and orders.
Funds are not at risk: private keys and recovery phrases remain out of reach.
Keystone destroys its stocks equipped with the old key and switches its sales to pre-order.
What happened at Keystone?
On October 24, 2026, the manufacturer of hardware wallets, Keystone published a press release on
The incident apparently took place on October 20, 2026 and the intrusion occurred through a flaw in a third-party data tracking tool, installed on the manufacturer's online store. This entry point offered the attacker much higher rights than expected.
After 3 days of investigations and after verification of API calls with Shopify, the company confirms the theft of customer files dating from 2024 to 2026.
In total, data from 25,964 buyer records fell into the hands of the attacker, as well as 12,873 abandoned shopping carts which also contained contact details. Sales made through Amazon and other channels are not affected.
The press release details the items recovered: names, contact details, delivery addresses and order details. The annoying part concerns the retention of this data. Keystone claims to delete them after 180 days, but its automatic deletion tool malfunctioned without the team noticing.
90 days is the new retention period. Erasure requests filed with Shopify must be completed by November 3, 2026.
“We owe you an apology. On October 20, we detected unauthorized access to our official website. You entrusted us with this information, and we are sorry for not having protected it. »
Keystone Hardware Wallet, October 24, 2026
Should you be worried about your funds?
No. Keystone is categorical and excludes recovery phrases, private keys, banking data and wallet passwords from the list of accessible elements. No one needs to move their funds.
Devices delivered before October 20, 2026 that pass the authentication check remain secure.
The real problem concerns the WebAuth key, engraved during manufacturing and impossible to modify afterwards. The October 24 press release distinguished the site incident from a compromise of the devices. A new announcement published this Monday, October 26 adds this key, used to prove that a device is authentic on keyst.one/authentication, without ever intervening on transactions.
For example, if a counterfeiter has this key, he can burn the same chip into a clone. The fake device would then pass the site inspection, and the buyer would have no way of doubting it.
The company blocked access, fixed the flaw and opened an investigation. With the stolen key, it also froze its stocks: 18,835 devices equipped with the old key were scrapped.
What should you do if your package arrived after October 20, 2026 with the old key? Keystone cannot “completely rule out” counterfeiting and asks to contact its support before any use.
The company has frozen shipments from the site and is switching its sales to pre-orders, while it produces devices with the new key.
A rule to remember in all cases: Keystone does not request the recall of any device. Any “recall” request that asks for your device is a scam.
