Keystone Updates Security Incident Response Progress: 18,835 Devices with Old Keys to Be Destroyed, Customer Information Retention Period Shortened to 90 Days

October 26 — Hardware wallet manufacturer Keystone released an update on its security incident response, disclosing that the incident involved 25,964 buyer records containing personal information, and that device verification keys obtained by attackers could be used to manufacture counterfeit devices that pass verification on the official website.

In response, Keystone will stop using the old keys, destroy the 18,835 devices in its inventory that use the old keys, and suspend shipment of unshipped orders placed on the official website, resuming shipments once devices using the new keys enter production; it will also shorten the retention period for customers' personal information from 180 days to 90 days. Keystone warned that for devices received after October 20 that use the old verification keys, even if they pass verification on the official website, the risk of counterfeiting cannot be fully ruled out, and users should contact customer service for further verification.