EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar26 Oct 2026
Hardware wallet maker Keystone said in an October 26 update that the attacker behind its website breach also obtained the key used to verify that devices are genuine. The company will destroy 18,835 wallets in stock and switch to a new authentication key. Recovery phrases and private keys were not affected, but fake devices and targeted scams are now the main risk.
Exchanges TradeReviewed News Desk
Keystone, which makes hardware wallets for Bitcoin and other crypto assets, has disclosed that its website breach was worse than first reported. In an update published on Monday, October 26, the company said the attacker also gained access to the authentication key used to check that Keystone devices are genuine, according to Brazilian outlet Livecoins. We first covered the incident in our original Keystone breach report.
Who is affected
Keystone said the incident involved 51,083 records, but 25,119 of them had already been deleted under its data retention policy. The remaining 25,964 records belonged to buyers and still held names, contact details, shipping addresses and order information from 2024 to 2026. Another 12,873 people who placed an order but never paid had the same kinds of data exposed. Keystone’s policy said buyer records should be deleted after 180 days, but the company admitted deletions were manual and a tool built to automate them did not work reliably.
The company says recovery phrases and private keys were not involved.
Why the authentication key matters
The more serious part is the authentication key. Keystone said the key is written into devices during manufacturing, cannot be erased or rewritten, and is used only to verify authenticity during its WebAuth process. It plays no role in generating seed phrases, deriving private keys or signing transactions. However, if exposed, an attacker could use it to build counterfeit devices that pass the authenticity check.
In response, Keystone says new devices will use a new authentication key and 18,835 wallets currently in stock will be destroyed. For devices bought before October 20, the date of the incident, the company says that a device passing authentication can be considered genuine and used normally.
What it means for traders
If you own a Keystone, the practical risk is social engineering. Keystone warned users to be wary of calls or messages offering help with “asset migration”, “wallet verification” or “investigation assistance”. Never enter a seed phrase into any website or app, and only buy hardware wallets directly from the manufacturer or authorized resellers, especially now that a counterfeit-friendly key is in the wild.
For funds you trade actively, keep only what you need on an exchange with strong security. Compare options in our exchange comparison, where BingX ranks #1 and OKX #2.
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.