Keystone, a maker of Bitcoin hardware wallets that keep the private codes controlling users' crypto offline, said Monday it will destroy 18,835 unsold devices after an attacker obtained the permanent factory key used to verify its products are genuine. The company has also suspended shipping of all unshipped orders placed through its website.

The breach, detected October 20, also affected 25,964 buyer records from Keystone's Shopify store, covering 2024 to 2026 and including names, contact details and shipping addresses. Keystone says recovery phrases and private keys were not involved, and that devices delivered before October 20 are unaffected.

For buyers, the practical risk is a counterfeit wallet that looks brand new and passes Keystone's own verification check, because the attacker obtained the very key the check relies on. A criminal could then sell such a device to someone who loads real savings onto it.

"If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks," Keystone said in its statement. "These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft."

Keystone calls the compromised credential a WebAuth key, a secret code written into each device at the factory so that a page on the company's website can confirm the hardware is real. It cannot be erased or rewritten, which is why the 18,835 units in inventory that carry it are being destroyed rather than sold — and why future devices must be built around a new key instead.

Keystone first said Saturday that a third party had obtained customer shipping information. Monday's statement added the stolen key and the count of 25,964 affected buyer records, but it does not say who is responsible or when the attacker first gained access.

The incident affected records from Keystone's Shopify store, the e-commerce platform that handled its online sales. Keystone says 51,083 buyer records were involved in total, but 25,119 had already had their personal information erased, leaving 25,964 records from 2024 to 2026 that still held names, contact details, shipping addresses and order information. Purchases made through Amazon and other channels were not affected.

Some of that data should already have been deleted, meaning part of what the breach exposed consisted of records Keystone had committed to erasing. The company's policy was to erase buyer records after 180 days, but the automated bulk-deletion tool it built for the job did not work reliably.

"Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period," Keystone said. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure."

Customer lists are a recurring weak point for hardware wallet makers. Ledger's 2020 leak eventually reached about 292,000 customers, and those who received phishing emails afterward worried they could become targets of home invasions. Trezor and SafePal each disclosed customer-data breaches in August, affecting 13,689 customers and about 39,798 customers, respectively.

— Keystone Hardware Wallet (@KeystoneWallet) October 26, 2026

Names and addresses matter because of so-called wrench attacks, in which criminals use threats or physical violence to force owners to hand over their crypto. Chainalysis counted 46 violent attacks in the first half of 2026, with more than $30 million stolen.

The manufacturer also warned of scammers offering "asset migration," "wallet verification" or "investigation assistance."

"We will not ask you to return your device," the company said. "Anyone contacting you under the pretext of a 'recall' and asking you to ship your device to them should be treated as a scammer."

Sales on Keystone's website will switch to preorders until production of devices with a new key is complete, and the company says it has submitted reports to authorities in the EU, UK and other jurisdictions.

Keystone has cut its retention period for customer data from 180 days to 90 and asked Shopify on October 24 to erase all overdue buyer data, a process with a 10-day waiting period. The company expects the erasure to finish on November 3, giving affected customers a concrete date to watch for.