Keystone, a manufacturer of Bitcoin hardware wallets, is destroying 18,835 unsold devices after a security breach. Attackers obtained a WebAuth key used to verify the authenticity of the hardware, which could allow the production of counterfeit wallets that pass official checks.
The company has suspended all shipments from its website. Sales will transition to a preorder model until new devices with secure keys are manufactured. Keystone has reported the incident to authorities in the UK, the EU, and other jurisdictions.
The breach involved customer data from Keystone’s Shopify store. A total of 25,964 buyer records, including names, contact details, and shipping addresses from 2024 to 2026, were exposed. Purchases made via Amazon and other channels remain unaffected.
Keystone attributed the data retention to a failure in its automated deletion tool, which was supposed to erase records after 180 days. The company has now reduced its data retention policy to 90 days and requested that Shopify delete all overdue buyer information by November 3.
The manufacturer warned customers against potential scams involving fake device recalls or offers for asset migration. Keystone stated it will not ask users to return their hardware and advised treating any such requests as fraudulent.
