Keystone to destroy 18,835 wallets after key theft

On October 26, 2026, Keystone confirmed the theft of its WebAuth authentication key. The company traced the intrusion to a vulnerability in a third-party data monitoring tool, which began as a compromise of customer information and escalated from there. The disclosure arrives with Bitcoin trading at $79,737 and Ethereum at $2,305.

A Key That Cannot Be Rewritten

The WebAuth key is how Keystone’s authenticity check recognizes a real device. In the wrong hands, it lets an attacker build counterfeit wallets that pass that check, which is a direct route to stolen funds for anyone who buys one unknowingly.

Keystone says the key is embedded permanently during manufacturing and cannot be erased or rewritten. That is why the company is scrapping every unit in inventory that carries it, rather than issuing a patch. New wallets will ship with a replacement authentication key.

The company says recovery phrases, private keys, wallet credentials, and payment information were not compromised, so owners do not need to move their crypto because of this incident. The advice on devices already in customers’ hands depends on timing:

• Devices delivered before October 20 are considered safe if they pass authentication
• Devices received after October 20 use the compromised key and need extra verification through customer support, even when authentication appears to succeed

The Customer Data Problem Sits Alongside It

The investigation also exposed a failure in how Keystone handles customer records. Of 51,083 Shopify buyer records, 25,964 still held personal information, including names, shipping addresses, contact details, and purchase histories from 2024 through 2026. Keystone says its automated deletion system malfunctioned, leaving data in place past its 180-day retention policy.

“We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure,” the company said.

Retention is now cut to 90 days, with new security reviews on the way. Keystone expects overdue deletion requests submitted on October 24 to be finalized by November 3. It has also submitted regulatory reports and plans further security audits.

Hashlytics Take

Hardware wallets sell one promise: you do not have to trust anyone with your keys. The authentication key is the one place that promise quietly turns back into trust, because buyers rely on it to know the device in the box is the real thing. Keystone lost it through a monitoring tool, not through its secure hardware, which tells you where the weak points in this industry actually sit. Destroying nearly 19,000 units is the expensive but correct call for a key that cannot be revoked. The real exposure is the stock already shipped after October 20, where a buyer who sees a passing authentication check has no way to know it means less than it used to. Anyone buying a wallet should be asking vendors how the authenticity key is stored and who else touches it.