Key facts
- Hackers stole a key used to verify Keystone hardware wallet authenticity.
- Stolen key could enable counterfeit wallets to pass authenticity checks.
- Keystone will destroy 18,835 devices with the compromised key.
- 25,964 buyer records and 12,873 incomplete checkout records were stolen.
Hardware wallet maker Keystone announced that an attacker who breached its website last week also stole a key used to verify the authenticity of its devices. This widens the scope of an incident initially reported as a customer data leak. The stolen authentication key could allow attackers to produce counterfeit wallets that pass authenticity checks, potentially leading to asset theft if customers unknowingly use them. Keystone plans to destroy 18,835 devices in its inventory that contain the compromised key and has suspended production shipments. Devices manufactured and delivered before October 20 are considered safe, but authenticity of later deliveries cannot be guaranteed. The company also disclosed that 25,964 buyer records and 12,873 incomplete checkout records were stolen.