Keystone destroys 18,835 hardware wallets, shipping on hold

Hardware wallet maker Keystone is destroying 18,835 finished devices from its own warehouse and has halted shipping. Behind that stands a cryptographic key. During the break-in on the company website on October 20, 2026, the so-called WebAuth key leaked, the key Keystone owners use to check online whether their device is genuine. That key is written permanently into the chip during manufacturing and cannot be swapped afterwards. The only option left to the maker is to destroy the affected batch.

For owners the picture is narrower than the number suggests. The recovery phrase is not affected, according to the company, and anyone who received their device before October 20 has nothing to return and no balance to move. The delivery date is what counts. This piece sets out what leaked, what the key can do technically, which devices are affected, and how to spot the scam wave that reliably follows reports like this.

The October 20 break-in: a gap in a third-party tool on the website

The web shop was attacked, not an individual device. According to the company, an attacker reached the official website on October 20, 2026 through a weakness in a bought-in tool for data monitoring. Such services sit inside a company's own page as third-party code and see everything that happens there. That exact design has become the entry point several times in recent weeks, at competitors too.

Two very different things leaked, by the company's account. First, customer data: 25,964 purchase records from 2024 to 2026 with names, contact details, delivery addresses and order details, plus 12,873 abandoned checkouts. Keystone had already acknowledged that part on October 25, and we described it in our report on the confirmed data breach. Second, and this is the new part of the story, the WebAuth key.

Untouched, according to the maker, are recovery phrases, private keys, other wallet credentials, bank payment data and identity document numbers. That line matters, because it marks the difference between an annoying data leak and a loss of funds.

The WebAuth key sits in the device from the factory and cannot be replaced

WebAuth key is Keystone's name for the secret with which a device proves to the maker's verification page that it came out of genuine production. The process behind it is standard in the industry and explained in two sentences: the device gets a secret burned in during manufacturing, the maker holds the counterpart to that secret, and during the check the device solves a task that only the right secret can solve. Pass the task, and it counts as genuine.

The catch lies in the word "burned in". The secret is written into the chip once and afterwards can be neither erased nor overwritten. You can change a password; a key in this form you cannot. Finished devices with the old secret therefore stay devices with the old secret permanently. Keystone has switched current production to a replacement key. For the stock already manufactured and sitting in the warehouse, that route did not exist.

18,835 warehouse devices go for destruction, shipping is paused

The consequence is unusually clear. 18,835 unsold devices with the old key are being destroyed; they will not go on sale and will not be delivered. Shipping through the website is paused, sales continue on pre-order. Anyone who wanted to order a hardware wallet from this maker in the coming days gets a delivery date instead of a parcel.

That decision costs the maker a complete batch and is the better news from a reader's point of view, because the alternative would have been shipping devices whose proof of authenticity is public. If you were facing a new purchase anyway, the criteria are in our hardware wallet comparison; since this year's incidents, the delivery route is a criterion of its own there.

Verification: a counterfeit could pass the online check

Why is a verification key worth protecting at all? Because verification is the last instance before someone types a recovery phrase into a device. A tampered hardware wallet is hard to spot from the outside and shows itself above all when the maker's check fails. Whoever holds the key could, according to the company and the specialist outlets reporting on it, build replicas that pass that check.

What is established is a possibility, not an incident. So far there is no report of counterfeits actually surfacing with the stolen key, and no report of funds lost through one. That is why the maker says explicitly that nobody has to move funds on account of this incident alone. The risk sits with future stock from unclear sources, hardly with the devices already in customers' hands.

How real that pattern is was shown by the Ledger case this year: devices carrying an extra chip circulated through resellers in Southeast Asia, and the damage ran to more than $86 million by analyst estimates we reported on October 9, 2026. The difference from today's case: at Ledger the distribution route was attackable, at Keystone the proof itself.

Recovery phrase and private keys remain untouched, according to the company

A recovery phrase, usually called a seed phrase, is the list of twelve or twenty-four words from which all of a wallet's keys can be derived again. That list is created on the device and never leaves it in normal use. That is precisely why a break-in at a web shop does not touch it: what sits there are orders, not keys.

This separation is the real value of self-custody, and in this case it holds. If you store your recovery phrase properly, you have nothing to do after this incident. If you are unsure whether your own storage holds up, the common mistakes are in our guide to storing a seed phrase safely.

The delivery date separates affected devices from unaffected ones

The maker draws the line at the day of the break-in. Devices delivered before October 20, 2026 remain safe to use, according to the company, provided they pass verification. That covers the large majority of devices in circulation, because the key only became known with the break-in.

The case is different for devices shipped after October 20 with the old key. Those customers should contact support and have an additional check carried out before using the device, the maker says. A second look at the shipping confirmation in your inbox therefore settles which of the two groups you are in.

Regardless of that, the handling of a new device stays the same: never set up a second-hand device or one from an unfamiliar dealer with an enclosed recovery phrase, and a device that wants to confirm a payment without a clear display deserves suspicion.

Keystone asks for no device back, and any return request is a scam

Here lies the bigger everyday risk of this incident, and it has nothing to do with technology. A report about destroyed devices is the perfect template for a scam: a letter in the maker's name, a supposed recall, an exchange programme, a "security migration". The leaked delivery addresses fit that neatly, because a message carrying your name and address sounds credible.

Keystone makes two things clear on this. The company asks nobody to send in a device, and anyone requesting that is a fraudster, in the maker's words. In its statement of October 26, 2026, titled "Statement Regarding the Security Incident on Our Official Website and Customer Guidance", the company also admits a failing on customer data through its @KeystoneWallet account: it did not keep its commitment to delete customer data on time and takes responsibility for that. An automatic deletion tool had failed without anyone noticing; the retention period now drops from 180 to 90 days.

Remember the simple rule: nobody who means well needs your hardware device or your twelve words. Any message demanding either can be deleted without further checking.

25,964 order records, and the home address as a risk of its own

The data side of the incident lasts longer than the key side. A delivery address is not changed like a password, and the combination of name, address and the information "owns a hardware wallet" is valuable to criminals. That ranges from targeted phishing emails to the rare but documented case of physical coercion.

In practice: expect post and emails in the coming months that spell your name correctly. That correctness proves nothing; it is a consequence of the leak. If you order again, choose a delivery route that keeps your home address out of the next database.

Is verification reliable again after the key swap?

Partly, and that honest answer is more useful than a reassuring formula. For new devices from the switched production line, what applied before applies again: a key known only to the maker and the device. For devices with the old key already in customers' hands, the online check can still confirm a genuine device, but it can no longer reliably rule out a replica built with the stolen key.

That weakness only runs out once the old batch has disappeared from the market, and that takes years. Until then the purchase route carries more weight than the verification tick: a device straight from the maker or an authorised dealer, sealed, with no words enclosed.

Four hardware wallet incidents this year, four different weak points

The Keystone case does not stand alone, but it repeats none of the earlier ones either. Set this year's incidents side by side and each hit a different point between manufacturing and user, and that is where the real lesson lies:

• Ledger, October 2026: tampered devices with an extra chip through resellers in Southeast Asia. Weak point: the distribution route.
• Coldcard, 2026: a fault in generating the recovery phrase that made private keys reconstructable. Weak point: randomness generation inside the device.
• Foundation, October 25, 2026: a separate incident in which phishing emails were sent from the maker's official domains; more than 23,000 attempts, according to the company, plus around 5,600 postal addresses and 5,200 phone numbers from older database copies. There were no indications of compromised devices or private keys. Weak point: the communication channels.
• Keystone, October 20 to 26, 2026: the proof of authenticity itself. Weak point: a non-replaceable secret inside an attackable website.

Two makers within two days, and in both cases an automatic deletion of old customer data failed. That connects the cases more strongly than the technology does: the weak point was not the device but the company around it. The hardware wallet itself delivered what it promises in all four cases, because the private keys stayed inside the device. Anyone drawing a conclusion from that draws it at the data trail of the purchase and at the delivery route, not at the choice of chip.

Keystone devices: the delivery date of October 20 decides

1. Dig out the shipping confirmation. If delivery was before October 20, 2026, there is nothing to do according to the company, as long as the maker's verification confirms the device. Delivered after that: contact support and have an additional check run. If a new purchase is due anyway, compare the delivery routes first in the hardware wallet comparison.
2. Ignore every recall message. Keystone asks for no devices back. Anyone urging you to send one in, to join an "exchange programme" or to enter your words is defrauding you, correct name and address included. To bridge the gap without a device of your own, the options are in the software wallet comparison.
3. Move funds only on genuine suspicion. A move of funds is not necessary on account of this incident alone. It becomes necessary if your device fails verification or comes from an unclear source: then a new device, a new recovery phrase, funds moved across. If you would rather not self-custody the coins in the meantime, the licensed places to go are among the regulated crypto exchanges.

The number 18,835 describes a batch in the warehouse, not the devices in customers' drawers. The maker drew that distinction itself, and it is the core of the report. Further detail is in the coverage by The Hacker News.

(As of October 28, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)