Keystone Factory Verification Key Stolen, Will Destroy 18,835 Inventory Wallets

On October 28, Decrypt reported that Bitcoin hardware wallet manufacturer Keystone stated that attackers had obtained its permanent factory WebAuth key, which is programmed into devices to verify hardware authenticity and could be used to manufacture counterfeit wallets that pass official verification. Keystone will destroy 18,835 unsold devices and suspend all unshipped orders on its official website. The incident was discovered on October 20 and also compromised 25,964 buyer records from its Shopify store from 2024 to 2026, including names, contact information, and shipping addresses. Keystone stated that mnemonic phrases and private keys were unaffected, devices delivered prior to October 20 remain unaffected, and warned users to be wary of scams disguised as “product recalls” or “asset migrations.”