Keystone will destroy 18,835 hardware wallets after thieves took its verification key

Keystone, the maker of the Keystone 3 Pro hardware wallet, will destroy 18,835 unsold devices after attackers stole the key its wallets use to prove they are genuine. The company said in a statement dated October 26, 2026 that the theft came through its website, that the key cannot be swapped out of units already manufactured, and that it knows of no stolen funds. The destroyed units are stock that had not reached buyers. Wallets already in customers’ hands are not part of the count.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

A key that cannot be rewritten after manufacturing

As The Hacker News reported, the key is written to each device during manufacturing, and the firmware accepts only one key and refuses a second. That rules out a software fix: the 18,835 devices carrying the old key cannot be moved to a new one. Someone holding the stolen key could build counterfeit devices designed to pass Keystone’s online authenticity check. Keystone has not said where the key was stored.

Keystone’s own engineering blog explains why the check exists. In its description of the system, each device gets a key pair installed in its secure element at manufacture, a verification server runs on an AWS hardware security module, and the two exchange a challenge shown to the user as a QR code. The design targets supply-chain tampering, devices altered or swapped in transit, and the blog says defeating it would require compromising both the server and the secure element.

What the stolen key could and could not do

The consequence of the theft follows from what the check is for. A verification key exists to answer one question, whether a unit came from the maker, and a copy in the wrong hands means a counterfeit built with it and a genuine wallet can both return a pass. That is why Keystone treats an old-key unit received after the compromise as unverifiable by the online check alone, which fits the decision to destroy rather than sell the 18,835 units in its inventory.

Keystone’s position is that the key touches nothing that holds money. “The key is used only for this check,” the company said, and it plays no role in creating recovery phrases, deriving private keys or signing transactions. In the company’s account, owners who already hold crypto have no need to move it because of the incident. No thefts and no counterfeit devices have been reported to Keystone.

The risk that remains is counterfeiting. For devices delivered before October 20 that pass the check, Keystone says normal use is fine. For a device received after October 20 that carries the old key, the company’s statement says that even if such a device passes authentication, Keystone “cannot completely rule out the possibility that it is counterfeit.” Keystone support, at [email protected], is the stated route for confirming such a unit. Keystone’s verification page separately tells owners of any device that fails the check to stop using it and to enter no seed phrase on it. Amazon and reseller buyers fall under the same arrival-date guidance.

Replacement, shipping and scam warnings

The statement as reported describes no replacement programme for current owners and no recall of wallets in the field. What it does describe is a reset on the supply side: all new devices will carry a new key, and shipping for website orders is paused until devices with that key are ready. The Keystone 3 Pro was listed as a pre-order expected to ship within four to six weeks as of October 27.

Keystone also warned that it will not ask anyone to return a device, and that unsolicited refund, replacement or recall offers should be treated as scams. Its earlier October 24 disclosure carried a similar caution about phishers posing as company representatives, according to Glitchwire.

A third-party tool, 25,964 buyer records and a retention promise

Keystone says the attacker exploited a vulnerability in a third-party data monitoring tool on its website to escalate privileges. The access was found on October 20 and blocked that day, and the flaw has been fixed. Glitchwire reported that Keystone confirmed three days later, after reviewing API logs with Shopify, that a third party had obtained the records, and the first public disclosure came on October 24. Keystone has not said when the attacker first got in.

Along with the key, the attacker obtained 25,964 buyer records from website purchases made between 2024 and 2026, holding names, contact details, shipping addresses and order details, plus 12,873 unpaid checkout records. Recovery phrases, private keys, payment card and bank details, government ID numbers and Amazon or other sales-channel records were not involved. Glitchwire reported that the company apologised for failing to keep the details safe.

The retention rule was meant to keep old records out of reach. Keystone’s privacy promises say shipping information is automatically deleted 180 days after an order. Keystone told customers that a bulk-deletion tool on its Shopify store worked unreliably and that some deletions failed without being caught in time. Retention is now 90 days, Shopify has been asked to purge older data, and Keystone expects that by November 3. As of October 27 the privacy policy still listed 180 days.

Keystone’s verification page showed no instructions for owners of old-key devices received after October 20 as of October 27, which leaves that group relying on a support email to learn whether a unit that passes the check can be trusted.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.