Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes

Keystone, a maker of Bitcoin hardware wallets that keep the secret codes controlling your crypto offline, said Monday it will destroy 18,835 unsold devices after attackers obtained the key that proves its hardware is genuine. The company has also suspended shipping of all unshipped orders from its website.

For buyers, the risk is a counterfeit wallet that looks brand new and passes Keystone’s own verification check, because the attacker obtained the key that the check relies on. A criminal could then sell such a device to someone who loads real savings onto it.

“If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks,” Keystone said in its statement. “These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.”

Keystone calls it a WebAuth key, a secret code written into each device at the factory so a page on the company’s website can confirm the hardware is real. It cannot be erased or rewritten, and the 18,835 units in inventory that carry it are being destroyed rather than sold.

Keystone first said Saturday that a third party had obtained customer shipping information. Monday’s statement added the stolen key and a count of 25,964 affected buyer records, but it does not say who is responsible or when the attacker first got in.

The incident affected records from Keystone’s Shopify store, the e-commerce platform that handled its online sales. Keystone says 51,083 buyer records were involved, but 25,119 had already had their personal information erased, leaving 25,964 from 2024 to 2026 that still held names, contact details, shipping addresses and order information. Purchases through Amazon and other channels were not affected.

BitcoinBTC · USD

$80,632−2.31%

Oct 20Oct 22Oct 24Oct 26Oct 27

$84.8k$83.1k$81.3k$79.6k

24h HighHigh$80,573

24h LowLow$79,416

VolVol$1.0B

→

Buy Bitcoin with USDT

Powered by Jupiter

Price data by CoinGeckoCoinGeckoMore Bitcoin news and projections →

Some of that data should already have been deleted. Keystone’s policy was to erase buyer records after 180 days, and the automated bulk-deletion tool it built for the job did not work reliably.

“Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period,” Keystone said. “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.”

Customer lists are a recurring weak point for wallet makers. Ledger’s 2020 leak eventually reached about 292,000 customers, and those who received phishing emails afterward worried they could become targets of home invasions.

Trezor and SafePal each disclosed customer-data breaches in August, affecting 13,689 customers and about 39,798 customers, respectively.

Names and addresses matter because of wrench attacks, in which criminals use threats or violence to force owners to hand over their crypto. Chainalysis counted 46 violent attacks in the first half of 2026, with more than $30 million stolen.

The manufacturer also warned of scammers offering “asset migration,” “wallet verification” or “investigation assistance.”

“We will not ask you to return your device,” the company said. “Anyone contacting you under the pretext of a ‘recall’ and asking you to ship your device to them should be treated as a scammer.”

Sales on Keystone’s website will switch to preorders until production of devices with a new key is complete, and the company says it has submitted reports to authorities in the EU, UK, and other jurisdictions.

Keystone cut its retention period for customer data from 180 days to 90 and asked Shopify on October 24 to erase all overdue buyer data, a process with a 10-day waiting period. The company expects the erasure to finish on November 3.