Keystone Confirms Security Incident: Approximately 26,000 Customer Records and Device Authentication Keys Leaked

On Oct. 26, according to a statement from Keystone Hardware Wallet (@KeystoneWallet), its official website was compromised on Oct. 20 when attackers exploited a vulnerability in a third-party monitoring tool, obtaining approximately 25,964 purchase records containing personal information, 12,873 unpaid checkout records, and device WebAuth authentication keys. Mnemonic phrases, private keys, and payment information were not affected. Keystone will destroy 18,835 devices in stock containing old keys, pause official website shipments and switch to a preorder system, while advising users that there is no need to transfer their assets and warning them to be vigilant against scams such as fake "recall" notices.