Cryptocurrency hardware wallet manufacturer Keystone has disclosed that its recent security breach was far more serious than first reported, revealing that attackers stole a critical authentication key that could enable counterfeit devices to pass the company's official verification checks.

The company made the expanded disclosure on October 26, 2026, having initially reported only the exposure of customer information. In response, Keystone plans to destroy 18,835 hardware wallets, halt pending shipments, and introduce stronger authentication safeguards.

Attackers Obtain WebAuth Key

Keystone first detected unauthorized access to its official website on October 20. Investigators later determined that the attackers exploited a vulnerability in a third-party data monitoring tool, which allowed them to gain elevated access privileges.

Among the data taken was Keystone's WebAuth key, the credential used to verify whether hardware wallets are genuine. Checks of this kind are what allow buyers to confirm a device is legitimate rather than a counterfeit or tampered unit, which places the credential at the center of trust in the product itself.

The key is embedded in devices during production, meaning it cannot be erased or replaced on units already in circulation — unlike a leaked password, it cannot simply be rotated. As a result, criminals could in theory produce counterfeit wallets capable of passing Keystone's official authentication process, potentially exposing unsuspecting cryptocurrency holders to asset theft. Keystone emphasized, however, that the stolen key cannot generate recovery phrases, derive private keys, or authorize cryptocurrency transactions. The company said it has not confirmed any cases of counterfeit devices exploiting the compromised credential.

18,835 Devices to Be Destroyed

Following the discovery, Keystone announced it will destroy 18,835 devices that contain the compromised authentication key. The company has also suspended shipments on outstanding website orders until replacement units become available.

Newly manufactured wallets will carry a different authentication key. In the interim, Keystone has moved its website sales to a preorder model as it prepares replacement inventory.

The investigation further revealed that hackers accessed personal information tied to 25,964 customer purchase records. Keystone also identified 12,873 incomplete checkout records that may have contained sensitive customer details. The exposed data included names, contact information, shipping addresses, and purchase histories. The company acknowledged that failures in its automated deletion system had allowed some customer information to remain stored longer than intended.

Users Urged to Watch for Scams

Keystone said wallets delivered before October 20 remain trustworthy provided they pass authentication checks. Customers who received devices containing the older key after that date are advised to contact official support for additional verification.

The company also cautioned users about fraudulent recall notices, replacement offers, and requests to transfer cryptocurrency assets. Keystone stressed that it will never ask customers to surrender recovery phrases or return devices through unsolicited recall requests. Such warnings carry added weight given the exposed records, since real names, addresses, and order histories can make fraudulent messages appear credible to recipients.

Although private keys and recovery phrases were not compromised, the incident underscores that security risks for hardware wallet makers extend beyond the devices themselves, encompassing customer data and the authentication systems that underpin investor confidence. Developments worth watching include whether any counterfeit devices are confirmed, when replacement shipments resume under the preorder model, and what form Keystone's promised stronger authentication safeguards will take.