Hardware wallet maker Keystone has pulled close to 19,000 devices from its sellable inventory and suspended all unfulfilled orders placed through its website, after an attacker obtained the cryptographic key the company uses to verify whether a Keystone wallet is genuine. The theft raises the prospect that counterfeit hardware could pass Keystone's own authenticity check.

In a statement posted on X, the company said the attacker obtained the WebAuth key that powers its device-authentication page — the mechanism buyers rely on to confirm a wallet shipped directly from the manufacturer. With that key in outside hands, a sophisticated attacker could theoretically use it to make a fake device appear legitimate to anyone running the standard verification process.

Keystone Destroys Inventory and Freezes Shipments

Rather than ship stock it could no longer reliably authenticate, Keystone said it will destroy 18,835 inventory devices carrying the old WebAuth key and will not sell or forward any unshipped website orders to customers.

Scrapping nearly 19,000 units is an unusual step for a hardware-wallet company and signals how seriously Keystone is treating the authentication gap. The company stressed that the WebAuth key is not used for recovery-phrase generation, private-key derivation, or transaction signing, meaning wallets already in users' hands remain functionally secure for managing crypto assets.

Keystone also confirmed that devices delivered before October 20 are unaffected, according to Decrypt. The company said it has filed incident reports in the EU, the UK, and other jurisdictions, though those are company-initiated disclosures and do not represent findings or enforcement actions by any regulator. For now, the disclosures on record are Keystone's own; any separate assessment from those authorities would be a new development to watch for.

Customer Data Also Caught Up in the Incident

Beyond the device-authentication issue, the episode also exposed personal information tied to Keystone's order history. Decrypt reported that 25,964 buyer records retained personal details from purchases made between 2024 and 2026.

Unchained reported a broader figure: 51,083 Shopify buyer records were involved in total, though 25,119 of those had already had their personal details wiped. The two outlets' numbers reconcile arithmetically: 51,083 minus the 25,119 wiped entries leaves 25,964 — exactly the count Decrypt cited as still holding personal details. An additional 12,873 unpaid checkout records also retained names, contact information, and shipping data.

The data exposure adds a separate privacy concern on top of the device-authenticity problem, particularly given that hardware-wallet customers are often identifiable as holders of cryptocurrency.

Why a Stolen Authentication Key Matters for Counterfeit Risk

Hardware wallets occupy a specific trust role in the crypto ecosystem: they are supposed to be tamper-evident, air-gapped devices that never expose private keys to an internet-connected computer. That promise depends partly on buyers being able to confirm they received genuine hardware rather than a device that was intercepted or swapped in transit.

The WebAuth key on Keystone's authenticity page was precisely the mechanism intended to address that supply-chain risk. If an attacker holds the key, any counterfeit device they produce could generate a valid-looking verification result, leaving a buyer with no reliable way to tell a legitimate device from a fake through the standard check. Keystone's response — replacing the key and destroying old stock — is consistent with treating the verification path as compromised rather than repairable in place.

It is worth noting that no confirmed counterfeit Keystone device has surfaced in public coverage of the incident. The company's disclosures describe the risk created by the stolen key, not evidence that fake devices have already reached buyers.

What Keystone Wallet Users Should Do Now

For users who already own a Keystone device, the company's statement that the WebAuth key plays no role in recovery-phrase generation, private-key derivation, or transaction signing is the most relevant piece of information. Existing wallets in legitimate users' hands are not directly compromised by the authentication-key theft, and seed phrases stored correctly remain protected. For product-specific guidance, the prudent course is to follow Keystone's official channels directly rather than act on third-party summaries.

For buyers who placed web orders that have not yet shipped, Keystone said those orders are being suspended. The company has not yet publicly detailed a replacement or reshipment timeline, so affected customers should monitor official Keystone communications for updates. Anyone considering purchasing a Keystone device on the secondary market or from a reseller should be especially cautious until the company releases new devices carrying a new authentication key, since old-key devices in secondary circulation cannot be verified through the previous authenticity page.

The incident is a reminder that supply-chain authentication is an active attack surface for hardware-wallet manufacturers, particularly as the value of assets held in self-custody grows. Broader crypto-market sentiment sits at Neutral (48) on the Fear and Greed Index, and Bitcoin trades near $80,646 — indicators of how substantial the population of self-custody users with meaningful holdings has become, and how directly financial the stakes of a compromised device can be.

The core question for Keystone now is how quickly it can reissue devices with a new, uncompromised WebAuth key and provide buyers with a trustworthy replacement authentication path. Until that process is complete and independently verifiable, the authenticity check the company built to protect customers against fake hardware remains unavailable.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.