keystone's device-authentication key was stolen. keystone says seeds and private keys were not involved.

on october 26, 2026, hardware-wallet maker keystone said an attacker who got into its official website also took the webauth key, the key its authentication page uses to check whether a device is genuine (keystone). keystone says recovery phrases, private keys and other wallet credentials were not involved.

what keystone says happened

• october 20: unusual access detected. its monitoring flagged unusual access. it disabled sensitive functions and blocked the access points that day; it also fixed the vulnerability (keystone).
• the way in: a third-party tool. the attacker exploited a vulnerability in a third-party data monitoring tool used by the website to escalate privileges (keystone).
• customer data. the incident involved 51,083 buyer records from the shopify store on keystone’s website. personal data had already been erased from 25,119 of them. the other 25,964 still held names, contact details, shipping addresses and order information from 2024 to 2026. a further 12,873 unpaid checkout records held submitted names, contact and shipping details. purchase data from amazon and other channels was not affected (keystone).
• two disclosures. the first post, october 24 at 17:59 utc, covered shipping data, not the key (keystone). the key came in the october 26 statement, 14:02 utc.
• the key. keystone says it is written into devices during manufacturing and cannot be erased or rewritten. it is used only to verify authenticity and plays no part in recovery phrase generation, private key derivation or transaction signing. with it, an attacker could produce counterfeit devices that pass the authentication check (keystone).
• inventory. production stops using the old key. the 18,835 old-key devices in stock will be destroyed. unshipped website orders are suspended; sales move to preorders (keystone).
• not reported. the statement does not report any counterfeit device found or any theft linked to the incident (keystone).

what a device-authentication key does

in 2021, keystone described each device as carrying a key pair installed in its secure element (the chip that protects keys) during manufacturing, used only for web authentication and separate from the wallet’s master keys created at setup (keystone blog). the device scans a qr code from the website and shows an 8-digit code, which the site checks (keystone support). the 2026 statement does not say how that design relates to the stolen key.

our assessment, not keystone’s

• it answers one question: is this box genuine? by keystone’s description, the key has no role in the keys that hold coins. by keystone’s account, it weakens the check on devices received after october 20, keystone’s cutoff.
• by keystone’s account, the risk sits in the next box, not the one in a drawer. a counterfeit that passes is a supply-chain problem, like a tampered device. a passed check was always one layer, not a device’s whole history.
• the customer data is the more immediate risk. names, addresses and orders make a convincing letter, call or email.

a separate incident: foundation

at 03:47 utc, earlier the same day, foundation, maker of the passport wallet, said spam emails appearing to come from its official domains had been sent. it traced them to compromised cloudflare api keys, all since revoked (foundation). neither statement links the two incidents.

what keystone tells owners

• delivered before october 20: authentication is unaffected. a device that passes can be considered genuine and used normally (keystone).
• received after october 20 with the old key: keystone says even a pass cannot fully rule out a counterfeit, and asks owners to contact support via the authentication page and use the device only after confirmation.
• no recall. keystone will not ask anyone to return a device. anyone asking for one under a “recall” should be treated as a scammer.
• no need to move assets solely because of this incident. keystone warns against messages offering “asset migration”, “wallet verification” or “investigation assistance”.
• the phrase stays put. keystone says never to enter a recovery phrase into a device you didn’t order, and to type keystone’s domain in yourself (keystone).

margin note: the “genuine” stamp got stolen. it was never the lock.

background: test your seed backup · wallet approvals: the permission you forgot you gave

sources

• keystone: statement, oct 26 · keystone: first disclosure, oct 24 · keystone: device verification · keystone support: web authentication · keystone blog, 2021 (archived) · foundation: announcement

not financial advice. dyor. you can lose all of your money. interests: see /disclosure.