Keystone, a hardware wallet manufacturer, disclosed on 24 October 2026 an intrusion into its online shop, then on 26 October the theft of the key that authenticates its devices. According to the company, the data of 25,964 buyers has leaked. Customer funds are not exposed, but 18,835 devices in stock are being scrapped.
What happened at Keystone?
On 20 October 2026, Keystone detected unauthorised access to its official website. According to Journal du Coin, the attacker got in through a flaw in a third-party data tracking tool installed on the shop. This entry point gave them far broader rights than intended.
The company reviewed the calls to its application programming interface (API) with Shopify. On 23 October it confirmed that a third party had obtained shipping information. It blocked the access, fixed the flaw and opened an investigation.
Two statements followed. The one from 24 October, published on X, concerns customer data and offers an apology. The one from 26 October adds a more sensitive element: the WebAuth key, which proves the authenticity of the devices, is among the items obtained.
What customer data has leaked?
According to Keystone, the attacker obtained 25,964 buyer records and 12,873 abandoned carts, dating from 2024 to 2026. These files contain names, contact details, shipping addresses and order details. Sales made through Amazon and other channels are not affected.
The retention period raises questions. Keystone says it deletes this data after 180 days, but its automatic deletion tool malfunctioned without the team noticing. The period is now being cut to 90 days. The deletion requests filed with Shopify are due to be completed on 3 November 2026.
| Item | Affected according to Keystone? |
|---|---|
| Names, contact details, shipping addresses | Yes |
| Order details | Yes |
| WebAuth device authentication key | Yes |
| Recovery phrases and private keys | No |
| Banking data | No |
| Wallet passwords | No |
What is a hardware wallet's authentication key for?
The WebAuth key is used solely to verify that a Keystone device is authentic. It is burned in during manufacturing and cannot be changed afterwards. It never plays any part in transactions.
The check is done on the keyst.one/authentication page. According to Keystone, the user scans a QR code with their device, enters the code displayed, then receives the result within one to two minutes. This test targets supply chain attacks, where a device is tampered with between the factory and delivery.
The theft of the key weakens precisely this safeguard. As Journal du Coin explains, a counterfeiter who holds it can burn the same chip into a clone. The fake device would then pass the website's check, without the buyer suspecting a thing.
Keystone has therefore frozen its stock. The 18,835 devices fitted with the old key are being destroyed. Shipments from the website are suspended and sales are moving to pre-orders while devices with a new key are produced.
Is my crypto wallet at risk?
According to Keystone, no. The company rules out recovery phrases, private keys, banking data and wallet passwords from the items that were accessible. Nobody needs to move their funds.
Devices delivered before 20 October 2026 that pass the authentication check remain safe, according to the manufacturer. Its verification page points out that private keys never leave the device and that the test exposes no sensitive data.
What should you do if you own a Keystone?
- Device delivered before 20 October 2026: run the verification on the official website. If it passes, Keystone considers it safe.
- Parcel received after 20 October with the old key: Keystone cannot "completely rule out" a counterfeit. Contact its support before any use.
- Failed verification: stop using the device, under no circumstances enter your recovery phrase on it, keep a screenshot of the result and write to support@keyst.one.
- "Recall" request: Keystone is not recalling any devices. Any message asking for yours is a scam.
The basic rule of crypto security does not change. During the fake Ledger update, the firm SlowMist summed it up this way: never enter your recovery phrase anywhere.
Why stolen addresses still matter
Our analysis: a name, an address and the details of an order are enough to make a fraudulent message credible. The scammer can mention a real purchase, which disarms the customer's suspicion.
There is a recent precedent. In October 2026, after the affair of the tampered Ledger devices sold in Southeast Asia, an e-mail signed "The Ledger Team" promised a firmware fix and asked for the 24 words. The scammers were counting on holders' anxiety, as they could do with Keystone's customers.
Journal du Coin sums up what is at stake: a wallet remains safe as long as its private key does not move. The weak link has become everything around it, from the shop to the parcel.
What about customers in Switzerland?
Keystone gives no breakdown of affected customers by country. The number of buyers residing in Switzerland therefore remains unknown. Despite the name, the company has no connection with the Swiss news agency Keystone-ATS.
The incident fits a trend that the Federal Data Protection and Information Commissioner (FDPIC) is following closely. It has received 455 reports of data breaches in Switzerland since the start of 2026, compared with 343 for the whole of 2025. According to the FDPIC, the interconnection of data increases the risk of breaches. Our analysis: the Keystone case illustrates this, since the attack came through a third-party tool connected to the shop.
What we do not know yet
- The name of the third-party data tracking tool through which the attacker got in.
- How the WebAuth key could be obtained during an intrusion into the website.
- Whether clones fitted with the stolen key are already circulating.
- When shipments will resume with devices carrying the new key.
- The number of customers affected in Switzerland.
