Keystone hardware wallet device-verification key stolen in website breach: counterfeit wallets could pass the authenticity check

Keystone said on 2026-10-26 that an attacker got into its website through a flaw in a third-party data monitoring tool, raised their privileges, and stole the key Keystone hardware wallets use to prove they are genuine, along with 25,964 buyer records (2024-2026 web-store orders on Shopify: names, contact details, shipping addresses, order details) and 12,873 unpaid checkout records. With the key, counterfeit devices can pass Keystone's online verification. Recovery phrases, wallet private keys and transaction signing are not affected. Keystone found the access and blocked it on 2026-10-20. It has not said when the attacker first got in. No counterfeit devices or thefts reported so far. At risk: anyone (org treasury, crypto custody teams) who received a Keystone device after 2026-10-20 from any channel, and buyers whose leaked addresses make them targets for phishing and fake 'recall/replacement' offers.

Summary written from the sources below. Check the originals before acting.