{"id":"CMP-202610-keystone-hardware-wallet-device-verification-key-stolen-in-w","kind":"campaign","aliases":[],"related":[],"title":"Keystone hardware wallet device-verification key stolen in website breach: counterfeit wallets could pass the authenticity check","description":null,"summary":"Keystone said on 2026-10-26 that an attacker got into its website through a flaw in a third-party data monitoring tool, raised their privileges, and stole the key Keystone hardware wallets use to prove they are genuine, along with 25,964 buyer records (2024-2026 web-store orders on Shopify: names, contact details, shipping addresses, order details) and 12,873 unpaid checkout records. With the key, counterfeit devices can pass Keystone's online verification. Recovery phrases, wallet private keys and transaction signing are not affected. Keystone found the access and blocked it on 2026-10-20. It has not said when the attacker first got in. No counterfeit devices or thefts reported so far. At risk: anyone (org treasury, crypto custody teams) who received a Keystone device after 2026-10-20 from any channel, and buyers whose leaked addresses make them targets for phishing and fake 'recall/replacement' offers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Keystone hardware wallet","fixed":[],"affected":"devices with the old verification key, received on or after 2026-10-20","ecosystem":"hardware"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Find Keystone hardware wallets delivered on or after 2026-10-20 (from any seller, including Amazon and resellers). Passing the online verification does not prove these are genuine.\n- Check whether staff bought from Keystone's web store in 2024-2026 (their shipping data leaked).\n- Watch for messages offering refunds, recalls, replacement devices or wallet verification.","fix":"- Do not use a Keystone device received after 2026-10-20 until Keystone support (support@keyst.one) confirms it is genuine.\n- Devices delivered before 2026-10-20 that pass the check can be used normally. Keystone says there is no need to move funds.\n- Treat any recall, refund, replacement or 'verify your wallet' contact as a scam. Never enter a recovery phrase into a device you did not order, and type keyst.one in the browser yourself.\n- Buy hardware wallets only from the vendor or authorized channels, and hold off on new Keystone orders until devices with the new key ship.","status":"open","published_at":null,"first_seen_at":"2026-10-27T12:26:35+00:00","triaged_at":"2026-10-27T12:26:35+00:00","updated_at":"2026-10-27T12:26:35+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':42B,136B,171B '-20':137B,172B '-2026':85B '-202610':20A '-26':43B '12':100B '2024':84B '2026':41B,135B,170B '25':80B '873':101B '964':81B 'access':130B 'address':96B,180B 'affect':126B 'along':78B 'anyon':158B 'attack':46B,144B 'authent':17A 'block':132B 'breach':11A 'buyer':82B,177B 'campaign':34B 'channel':175B 'check':18A 'checkout':103B 'cmp':19A 'contact':93B 'could':14A 'counterfeit':12A,108B,149B 'crypto':161B 'custodi':162B 'data':59B 'detail':94B,98B 'devic':5A,109B,150B,168B 'device':25A 'device-verif':4A 'earli':36B 'early-warn':35B 'fake':187B 'far':155B 'first':145B 'flaw':53B 'found':128B 'genuin':77B 'got':47B,146B 'hardwar':2A,70B 'hardware':23A,32A 'in':29A 'key':7A,27A,68B,107B,120B 'keyston':1A,38B,69B,112B,127B,167B 'keystone':22A,31A 'keystone-hardware-wallet-device-verification-key-stolen-in-w':21A 'leak':179B 'make':181B 'monitor':60B 'name':92B 'offer':189B 'onlin':114B 'order':89B,97B 'org':159B 'parti':58B 'pass':15A,111B 'phish':185B 'phrase':117B 'privat':119B 'privileg':64B 'prove':74B 'rais':62B 'recall/replacement':188B 'receiv':165B 'record':83B,104B 'recoveri':116B 'report':153B 'risk':157B 'said':39B,141B 'ship':95B 'shopifi':91B 'sign':123B 'stole':66B 'stolen':8A,28A 'store':88B 'target':183B 'team':163B 'theft':152B 'third':57B 'third-parti':56B 'tool':61B 'transact':122B 'treasuri':160B 'unpaid':102B 'use':72B 'verif':6A,115B 'verification':26A 'w':30A 'wallet':3A,13A,24A,33A,71B,118B 'warn':37B 'web':87B 'web-stor':86B 'websit':10A,50B 'whose':178B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-keystone-hardware-wallet-device-verification-key-stolen-in-w","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-27T12:26:35+00:00","fetched_at":"2026-10-27T12:26:35+00:00","note":null}],"documents":[{"id":6149,"url":"https://x.com/TheHackersNews/status/2115047606816768469","title":"@TheHackersNews: 🚨 Keystone to destroy 18,835 hardware wallets after hackers stole its device ver","kind":"post","source":"x","text":"🚨 Keystone to destroy 18,835 hardware wallets after hackers stole its device verification key.\n\nThe stolen key could let counterfeit wallets pass as genuine. The breach also affected 25,964 buyer records.\n\nWhat to do ↓ https://t.co/TT04S7JKVY\n\nlikes 2 reposts 2","published_at":"2026-10-27T11:46:59+00:00","relation":"describes","confidence":null,"note":null},{"id":6236,"url":"https://t.co/TT04S7JKVY","title":"The Hacker News: Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key","kind":"blog","source":"analyst","text":"An attacker who gained access to Keystone's website (via a vulnerability in a third-party data monitoring tool, privilege escalation) obtained the device verification key its hardware wallets use to prove they are genuine (Keystone statement Oct 26). Counterfeit devices with the key could pass the online authenticity check. Recovery phrases and wallet private keys not involved. Keystone found access Oct 20, blocked it, fixed the vuln; first access date not disclosed. 18,835 unsold devices with old key to be destroyed; new devices get new key. Devices delivered before Oct 20 that pass check are genuine; devices received after Oct 20 with old key: contact support@keyst.one before use. 25,964 buyer records (2024-2026 website purchases on Shopify: names, contact, shipping addresses, orders) plus 12,873 unpaid checkout records affected. No counterfeits or thefts reported. Expect phishing: refund/recall/replacement/wallet verification offers are scams.","published_at":"2026-10-27T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}