Hardware wallet maker Keystone said the attacker behind last week's breach of its website also stole a key used to verify the authenticity of its devices, widening the scope of an incident that was initially disclosed as a customer data leak.

In a statement on X on Monday, Keystone warned that the stolen authentication key could allow attackers to produce counterfeit wallets that pass the company's authenticity checks.

"These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft," Keystone said.

Hardware wallets are designed to keep the private keys controlling crypto holdings offline, and authenticity checks exist to confirm a device is genuine before it is set up. With the verification key itself stolen, the safeguard now compromised is the very check meant to catch counterfeits.

The disclosure adds Keystone to a series of attacks targeting hardware wallet manufacturers this year. Earlier this month, Ledger asked resellers across Southeast Asia and Hong Kong to suspend sales after reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases. In late July, Coinkite, the maker of Coldcard, issued a warning to users after attackers exploited a bug that caused its devices to generate wallet seeds with less entropy than intended, resulting in the theft of millions of dollars in crypto.

Keystone to destroy more than 18,000 devices with old key

According to Keystone's latest update, the attacker exploited a vulnerability in a third-party monitoring tool used by the company's website to escalate privileges.

"This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices," the company said.

Keystone said it plans to destroy 18,835 devices in its inventory that contain the compromised key and has suspended production shipments of all devices using it. Shipments will resume once the company begins producing devices with a new authentication key. Keystone has not announced a timeline for the switch; the company published Monday's update on its X account.

The company said devices manufactured and delivered before the Oct. 20 incident should be considered safe, and that their authenticity checks remain trustworthy. However, it could not guarantee the authenticity of devices delivered after that date and urged affected customers to contact its support team for additional verification.

Keystone confirms 25,964 buyer records leaked

Keystone also disclosed the extent of the customer data breach, saying its website's Shopify store had generated 51,083 buyer records. Of those, 25,119 had been deleted under its 180-day data retention policy.

The remaining 25,964 records, dating from 2024 to 2026, may have been stolen by the attacker. Keystone attributed the retention of the older entries to a failure in its automated tool for bulk erasure of data.

"The tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period," Keystone said.

The attacker may also have had access to 12,873 customer checkout records retained by Shopify — information from purchases that had not been completed. Keystone said it had contacted Shopify to request the deletion of personal information in checkout records retained for more than 30 days.

A year of hardware wallet breaches

Monday's disclosure echoes a June 2020 data breach at Ledger that exposed more than 1 million email addresses, along with customer names, phone numbers and physical addresses. The leaked information fueled years of phishing attempts targeting affected users.

Other hardware wallet manufacturers have also suffered breaches involving customer information and third-party services this year. In August, Trezor disclosed a breach at its shipping partner that exposed customer information, with the number of affected users expanding to more than 80,000 in September. SafePal also reported an order-tracking vulnerability in August that exposed data belonging to nearly 40,000 customers, while BitBox was targeted in a September phishing campaign involving a compromised third-party email provider.

Keystone's incident fits the vendor exposure running through this year's breaches: its attacker entered through a third-party monitoring tool, just as Trezor's breach traced back to a shipping partner and the BitBox phishing campaign to a compromised email provider.

Source: Cointelegraph