Crypto hardware wallet maker Keystone said it will destroy 18,835 unsold devices after an attacker stole a security key used to verify that its wallets are genuine.
The company said that the stolen key could allow criminals to create counterfeit devices that pass its online authentication check. This means that users who trust a fake device could lose their cryptocurrency. However, the breach did not expose wallet private keys or recovery phrases, the company said.
Keystone discovered the unauthorized access on October 20. The attacker exploited a weakness in a third-party monitoring tool used by the company's website to gain access to customer data and the security key. Keystone said it has blocked the attacker and fixed the vulnerability.
The breach also exposed 25,964 customer records from purchases made through Keystone's website between 2024 and 2026. The records included names, contact details, shipping addresses and order information. Another 12,873 records from unpaid checkouts were included in the company's response as a precaution.
Keystone said payment card details, bank information and government ID numbers were not affected. Purchases made through Amazon and other sales channels were also unaffected.
The company advised customers who received devices after October 20 to contact support if their wallets use the old security key. Users should only use the devices after Keystone confirms they are genuine. Devices received before October 20 that pass authentication can be used as usual, the company said.
Keystone plans to replace the compromised key in all new devices. The company has not revealed when the attacker first gained access or where the stolen key was stored.