Keystone to destroy 18,835 devices after website breach exposed buyer records and authenticity key

The incident exposed 25,964 records pertaining to buyers across 2024 through 2026. These records included names, shipping addresses, order details, and contact information. Furthermore, an additional 12,873 unpaid checkout records may have been impacted.

The security lapse occurred on October 20 when an attacker gained access via a vulnerability in a third-party data monitoring tool, Keystone reported on X Monday.

A critical element compromised was a key embedded in devices during production. This key enables wallets to pass online authenticity validations, increasing the danger that counterfeit devices could appear legitimate and jeopardize user assets, according to the firm.

Keystone stated that the breach did not reveal private keys, recovery phrases, or wallet credentials. The company also acknowledged that some customer data should have been purged under its 180-day retention policy, but an automated deletion mechanism malfunctioned without internal detection.

The institution stated, “We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.”

This event follows disclosures from other entities, such as Foundation, which reported a distinct breach involving phishing emails and also found older database copies missed by its 60-day data deletion process.

Market participants should note that this situation adds to a pattern of security incidents affecting hardware wallet users, including compromises at Ledger and Coldcard.

These developments underscore the persistent regulatory and operational challenges facing institutions managing sensitive digital asset infrastructure.

Why it matters

This incident highlights ongoing security vulnerabilities within the hardware wallet industry, where compromised keys can undermine device authenticity. Regulators and exchanges are closely watching these types of breaches as they directly impact consumer trust and the integrity of digital asset custody.