- The attacker obtained a key used in the authenticity test of Keystone wallets. A counterfeit could pass this test, so the company announced it would destroy 18,835 devices from stock.
- Data from almost 26,000 were also disclosed. purchase records, including shipping addresses. The company assures that the leak did not affect recovery phrases or private wallet keys.
- Keystone does not require the return of devices. Any request to send your wallet back is a scam.
What exactly leaked?
The company discovered unauthorized access to its website on October 20. According to Keystone, the hacker entered through a vulnerability in a third-party data monitoring tool and elevated his privileges. The attack affected the verification key and store data.
The first element is the so-called WebAuth key. Keystone Wallet receives it during production and uses it for authentication checks on the company’s website. According to Keystone, the key is not involved in creating the recovery phrase, private keys, or signing transactions.
The second one is customer data from the online store. According to the company, 25,964 buyer records from 2024 to 2026 included name, contact, shipping address and order details. In addition, there are 12,873 unfinished orders. Keystone admits that it was supposed to delete this data after 180 days. The deletion tool was intermittent and the company did not timely detect that some deletion tasks were failing. She reported the incident to supervisory authorities in the European Union, Great Britain and other countries.
Why does Keystone destroy devices?
A stolen key may enable the preparation of a counterfeit that cannot be distinguished from the original by the test. Keystone warns that with this key, a counterfeit device may pass its authenticity check. A counterfeit wallet may, in turn, steal the recovery phrase that you enter during configuration.
The key cannot be deleted or overwritten in the finished device. A software update won’t fix this. New wallets will receive a new key, and until they are produced, the store only accepts pre-orders. According to Keystone, the data leak did not affect orders placed through Amazon and other sales channels. However, this is not a separate confirmation of the authenticity of each device from these channels.
What to do if you have Keystone?
According to Keystone’s recommendations, the delivery date is important. A device received before October 20 can continue to be used as long as it passes the authenticity test. A device with an old key received after October 20 requires additional verification by official support before use, even if the test passes.
If the test fails, stop using the device and do not enter the recovery phrase into it. Keystone does not ask you to transfer funds and asks you to ignore messages about “asset migration” or “portfolio verification”. According to the company, anyone who asks for the wallet to be sent back is a scammer.
Why is the address in the database a problem?
Buyer data can help fraudsters target people who are likely to have cryptocurrencies. Knowing the name, address and order details also makes it easier to impersonate the manufacturer, for example in a phone call or email about the supposed return of the device.
Keystone expects to complete deletion of outstanding data from the store by November 3, and reduce the retention period to 90 days. However, this will not delete a copy that the attacker may have already downloaded.
