Keystone to Destroy 18,835 Hardware Wallets With Old Key After Incident
Keystone said its WebAuth key for verifying device authenticity was compromised during a breach of its website. The company halted shipment of unshipped orders and will destroy 18,835 unsold units containing the old key.
The compromised WebAuth key prompted Keystone to halt shipment of unshipped orders from its own website and dispose of 18,835 unsold devices from its warehouse. The company said the attacker obtained the key used to verify hardware authenticity during the breach of its website.
The WebAuth key is part of the mechanism through which Keystone Device Verification confirms the authenticity of a device and its firmware. According to the company, the key was embedded in the devices during manufacturing. It therefore cannot be removed or replaced with a new one in existing units.
Compromised key weakens authenticity verification
According to the information available so far, the main risk is not access to wallets already in use, but the reliability of the verification process for devices with the old key. If the compromised key were misused, it could enable the production of counterfeit devices that pass the official authenticity check.
Keystone claims that the incident did not affect seed phrases, private keys or the transaction-signing process. Hardware wallets are used to store private keys outside devices connected to the internet. However, the company’s claim that cryptographic data was not affected has not yet been independently confirmed through forensic analysis.
It has likewise not been confirmed that attackers have already manufactured or distributed counterfeit devices. There are also no confirmed cryptocurrency thefts linked to this incident.
Disposal of warehouse units and a new manufacturing key
The company announced a transition to a new key and the disposal of all 18,835 unsold devices containing the original key. It also suspended shipment of orders that had not yet been sent from its own website.
This measure applies to warehouse units for which the old manufacturing key cannot be replaced retroactively. Keystone has not yet provided independent technical confirmation of the incident’s scope or details about how the attacker obtained the key.
According to the available information, the risk primarily concerns devices delivered after October 20, 2026, with the old key. Owners of such products should monitor further instructions from the manufacturer and exercise caution with communications posing as Keystone support.
What remains unclear
The number of potentially affected customer or checkout records is unknown; the available information in this area comes from the company. It also remains an open question whether Keystone will issue a technical report, the results of an independent audit or additional indicators of compromise.
For customers, it will be important when the manufacturer confirms completion of the manufacturing-key replacement and the resumption of shipments. It will also matter whether confirmed counterfeits, misuse of customer data or targeted phishing campaigns emerge.
The compromised key therefore does not mean a confirmed breach of existing wallets, but it represents a supply-chain problem. The mechanism intended to verify hardware trustworthiness may no longer reliably distinguish an original from a counterfeit when the old key is used.
Sources
- Keystone Device Verification – Confirms the purpose of the Device Verification service: checking the authenticity of the device and firmware.
- The Hacker News – Reports the company’s announcement about the compromised WebAuth key, disposal of 18,835 units and shipment suspension.
- Unchained via Yahoo Tech – Corroborates the scope of the measures, the risk of counterfeits and Keystone’s statements that seed phrases and private keys were not affected.
Verified and updated: October 27, 2026 15:21
