Threat watch / Breach
Keystone: an attacker takes buyer data and the key that proves its hardware wallets are genuine
Hardware wallet maker Keystone detected unauthorized access to its official website on October 20, 2026. The attacker took 25,964 buyer records from its Shopify store and the WebAuth factory key used to check that a device is genuine. Keystone is destroying 18,835 unsold devices that carry that key, because someone holding it could make counterfeits that pass the check. It says recovery phrases and private keys were not involved.
- Sector
- Consumer apps & devices
- Way in
- Software flaw
- Product or vendor
- Keystone
- How it happened
- According to Bankless, Blockhead and ForkLog, Keystone says the attacker exploited a vulnerability in an unnamed third-party data monitoring tool on its website to escalate privileges, which gave access to the Shopify buyer records and to the WebAuth key behind the device authentication page. Decrypt notes that the statement does not say when the attacker first got in or who is responsible.[1][2][3][4] Checked 9 Nov 2026
- What was stolen
- 25,964 buyer records from the Shopify store (2024 to 2026 orders): names, contact details, shipping addresses and order information, plus 12,873 unpaid checkout records with names and shipping details. The attacker also took the WebAuth factory key, which is written into each device and cannot be erased. Keystone says recovery phrases, private keys, bank payment details and government ID numbers were not exposed.[1][2][3][4] Checked 9 Nov 2026
- Who was impacted
- Customers who ordered from Keystone's official web store between 2024 and 2026; Amazon and other sales channels were not affected. Keystone says devices delivered before October 20 are unaffected, and that for a device with the old key received after that date it "cannot completely rule out the possibility that it is counterfeit".[1][2][3] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- Keystone detects unauthorized access to its official website. [2][3]
- Keystone confirms that a third party obtained customer shipping information. [3]
- Keystone discloses the breach and apologizes: "We owe you an apology." It asks Shopify to erase buyer data kept past its 180-day retention period, because some of its own erasure tasks had failed. [2][3][4]
- In a fuller update, Keystone says the attacker also took the WebAuth device authentication key. It will destroy 18,835 unsold devices carrying it, suspends shipping of unshipped web orders, moves web sales to preorders and cuts retention to 90 days. It says it has reported to authorities in the EU, the UK and elsewhere. [1][2][3][4]
- Date by which Keystone expected Shopify to finish erasing the overdue buyer data. [2][3][4]