---
id: "CMP-202610-keystone-hardware-wallet-device-verification-key-stolen-in-w"
kind: "campaign"
aliases: []
title: "Keystone hardware wallet device-verification key stolen in website breach: counterfeit wallets could pass the authenticity check"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Keystone hardware wallet", "fixed": [], "affected": "devices with the old verification key, received on or after 2026-10-20", "ecosystem": "hardware"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T12:26:35+00:00"
updated_at: "2026-10-27T12:26:35+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T12:26:35+00:00"}]
---

# Keystone hardware wallet device-verification key stolen in website breach: counterfeit wallets could pass the authenticity check

Keystone said on 2026-10-26 that an attacker got into its website through a flaw in a third-party data monitoring tool, raised their privileges, and stole the key Keystone hardware wallets use to prove they are genuine, along with 25,964 buyer records (2024-2026 web-store orders on Shopify: names, contact details, shipping addresses, order details) and 12,873 unpaid checkout records. With the key, counterfeit devices can pass Keystone's online verification. Recovery phrases, wallet private keys and transaction signing are not affected. Keystone found the access and blocked it on 2026-10-20. It has not said when the attacker first got in. No counterfeit devices or thefts reported so far. At risk: anyone (org treasury, crypto custody teams) who received a Keystone device after 2026-10-20 from any channel, and buyers whose leaked addresses make them targets for phishing and fake 'recall/replacement' offers.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- hardware:Keystone hardware wallet affected devices with the old verification key, received on or after 2026-10-20 fixed ?

## How to check

- Find Keystone hardware wallets delivered on or after 2026-10-20 (from any seller, including Amazon and resellers). Passing the online verification does not prove these are genuine.
- Check whether staff bought from Keystone's web store in 2024-2026 (their shipping data leaked).
- Watch for messages offering refunds, recalls, replacement devices or wallet verification.

## Fix

- Do not use a Keystone device received after 2026-10-20 until Keystone support (support@keyst.one) confirms it is genuine.
- Devices delivered before 2026-10-20 that pass the check can be used normally. Keystone says there is no need to move funds.
- Treat any recall, refund, replacement or 'verify your wallet' contact as a scam. Never enter a recovery phrase into a device you did not order, and type keyst.one in the browser yourself.
- Buy hardware wallets only from the vendor or authorized channels, and hold off on new Keystone orders until devices with the new key ship.

## Timeline

- 2026-10-27T12:26:35+00:00 analyst

## Documents

- [describes] @TheHackersNews: 🚨 Keystone to destroy 18,835 hardware wallets after hackers stole its device ver https://x.com/TheHackersNews/status/2115047606816768469
- [describes] The Hacker News: Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key https://t.co/TT04S7JKVY

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_