Keystone is set to destroy 18,835 hardware wallets that contain a compromised WebAuth key. The company identified a security breach on its official website on October 20, 2026, where an attacker exploited a third-party monitoring tool to gain elevated privileges.
The compromised key, which is embedded during manufacturing and cannot be updated, could theoretically allow for the creation of counterfeit devices that pass authentication checks. Keystone has suspended current shipments and will transition to a pre-order model until new devices with secure keys are available.
The data breach affected 25,964 customer records from Shopify orders placed between 2024 and 2026, exposing names, contact details, and shipping addresses. Additionally, 12,873 records of incomplete orders were compromised. Keystone noted that some data was retained beyond the 180-day limit due to automated deletion errors.
The company is reducing its data retention period from 180 to 90 days, with deletion requests sent to Shopify on October 24. Keystone confirmed that seed phrases, private keys, and payment information remain secure, and users do not need to move their assets as a result of this specific incident.
