Keystone, the hardware wallet maker, will destroy 18,835 unsold devices and has suspended shipments after a security breach, CoinDesk reports from the company’s own disclosure on Monday.
An attacker got into Keystone’s website on 20 October through a flaw in a third-party data monitoring tool. Records on 25,964 buyers from 2024 to 2026 were exposed, covering names, contact details, shipping addresses and order information. A further 12,873 unpaid checkout records may also have been affected.
Keystone says recovery phrases, private keys and wallet credentials were not touched. Bitcoin.com and other outlets report the same on the customer data. The harder problem is a key written into devices at the factory, which cannot be changed. It lets a wallet pass online authenticity checks, so in principle a counterfeit could look genuine.
The company also admitted that an automated tool meant to delete customer data after 180 days had failed unnoticed, leaving some records longer than its policy allows. It says it will move to 90-day retention, sell by preorder, and issue a new key for new devices.
Its advice is that devices delivered before 20 October are safe if they pass authentication, and that users need not move funds because of the breach alone. The destruction figures come from CoinDesk’s reading of the company’s report and were not in the first wave of coverage.
What nobody has said is whether the key has been used to make a fake device, or how many units shipped after 20 October carrying the old one.
