Keystone says stolen authentication key forces destruction of 18,835 wallets

Key points

• Keystone disclosed on 26 Oct 2026 that attackers stole the WebAuth key used to authenticate its hardware wallets.
• All 18,835 devices in existing inventory will be destroyed; new wallets get a replacement key.

The manufacturer traced the intrusion to a flaw in a third-party data monitoring tool that let attackers escalate their access. Keystone spotted suspicious activity on 20 Oct, disabled the affected website functions and began a forensic investigation.

An attacker holding it could build counterfeit devices that pass Keystone's authenticity checks, potentially exposing buyers to asset theft. Keystone plans to destroy all 18,835 units in stock and give newly made wallets a replacement key. Shipments of outstanding website orders are suspended, with preorders taken until replacement production is ready.

Keystone said its automated deletion system had malfunctioned, leaving data stored beyond its 180-day retention policy.

Devices delivered before 20 Oct remain safe if they pass authentication, while later ones using the compromised key need extra checks through customer support.

What to watch: Keystone expects overdue buyer data deletion requests submitted on 24 Oct to be finalised by 3 Nov, and plans breach lookup tools and further security audits.

Read the full story on Bitcoin.com News →