In Brief:
- Keystone’s website security breach exposed 25,964 customer records, including personal details, while investigators identified additional incomplete checkout records containing information.
- Attackers compromised Keystone’s device authentication key, prompting the company to destroy 18,835 devices and suspend shipments to prevent counterfeiting.
- Keystone confirmed wallet credentials remained secure while introducing stricter data retention policies, customer notifications, and additional security verification measures.
Hardware wallet provider Keystone has confirmed a security breach exposing 25,964 customer records and compromising a device authentication key. According to Keystone’s official statement, attackers exploited a third-party monitoring vulnerability, prompting the company to suspend shipments and strengthen security measures.
Keystone Security Breach Exposes Customer Information
Keystone detected unauthorized access to its official website on October 20, 2026, and immediately restricted sensitive functions while investigating the incident. Investigators discovered that attackers accessed Shopify purchase records containing customer information collected between 2024 and 2026.
Also Read: BlackRock Partners With Ripple-Linked SBI to Explore Tokenized Funds and JPYSC
The breach involved 51,083 buyer records, including 25,964 containing personal information such as names, contact details, shipping addresses, and purchase histories. Meanwhile, another 25,119 records had already undergone anonymization, meaning their associated personal information was unavailable during the unauthorized access.
Investigators also identified 12,873 incomplete checkout records containing customer details, which Keystone included in its response as a precaution. Keystone acknowledged that failures in its automated deletion system allowed customer information to remain stored beyond its established retention period.
Compromised Authentication Key Forces Keystone to Destroy 18,835 Devices
We're back on X.
— 36Crypto (@36Crypto1) August 21, 2026
Our previous account (36crypto2) is currently unavailable while we continue working through the appeal process. In the meantime, this is our new official account. While you are on this page, please support us by sharing and following.
Beyond customer information, attackers obtained Keystone’s WebAuth key, which verifies whether hardware wallet devices are genuine during authentication checks. The compromised key could enable counterfeit devices to pass verification, potentially exposing unsuspecting customers to cryptocurrency theft.
Consequently, Keystone announced plans to destroy 18,835 existing devices containing the compromised key and introduce replacement authentication credentials.
The company also suspended outstanding shipments and shifted toward preorders until newly manufactured devices become available. Customers receiving devices after October 20 with the old authentication key must request additional verification before using them.
Keystone Introduces Additional Customer Protection Measures
Keystone confirmed that recovery phrases, private keys, banking information, and government identification numbers remained unaffected by the security breach. Additionally, the company shortened its customer data retention period from 180 days to 90 days while improving deletion procedures.
Affected customers will receive email notifications, while planned verification services will allow users to check their exposure and data deletion status. Keystone expects overdue purchase records to be erased by November 3 and has submitted regulatory reports across several jurisdictions.
The company will also conduct further security audits and strengthen its authentication systems to address vulnerabilities identified during the investigation.
Also Read: Ripple Ex-CTO David Schwartz Reveals Two Major Risks That Could Shut Down XRP Ledger
