Keystone to Destroy 18,835 Wallets After Security Breach

Keystone will destroy 18,835 unsold hardware wallets and halt outstanding shipments after an attacker obtained the permanent factory key used to verify device authenticity. The company discovered the breach on October 20 and says the stolen key cannot access recovery phrases, private keys or transaction signing. Devices delivered before the incident are considered unaffected if they pass authentication; customers who received later devices using the old key should contact Keystone support before use. New website orders are being taken by preorder while production switches to new verification keys. The incident also exposed customer data held by Keystone’s Shopify store. Of 51,083 records initially implicated, 25,964 still contained personal and order details, while 12,873 unpaid checkout records also held customer information. The later update says 25,119 personal records have been deleted; customers who bought through Amazon and other channels were not affected. Keystone acknowledged that a faulty bulk-erasure tool left some records beyond the planned 180-day retention period. It has reduced retention to 90 days and asked Shopify to delete overdue data, with completion expected by November 3. The company has reported the incident to authorities in the EU, UK and other jurisdictions. For crypto traders, the Keystone breach highlights risks in hardware-wallet supply chains and customer-data handling, but there is no reported loss of crypto assets or compromise of transaction signing. The incident could weigh on confidence in Keystone’s products, but it does not indicate a direct security issue with Bitcoin or the wider crypto network.