Keystone to Destroy 18,835 Wallets After Device Authentication Key Theft

Keystone plans to destroy 18,835 unsold hardware wallets after an attacker obtained a key used to verify whether its devices are genuine. The company disclosed the wider scope of the incident on October 26, including access to customer information from its online store.

Keystone supports several Cardano wallets, including Lace and Eternl. Lace added Keystone support in August, allowing users to manage Cardano assets while approving transactions on the hardware device.

Website Breach Exposes Device Verification Key

Keystone detected unusual access to its official website on October 20. Its investigation found that the attacker exploited a vulnerability in a third-party data monitoring tool used by the site, gaining elevated privileges and access to customer information and the device authentication key.

The affected WebAuth key is written into devices during manufacturing and cannot be erased or replaced. Keystone uses it to verify whether a device is genuine through its authentication page.

According to the company, possession of the key could allow an attacker to create counterfeit devices that pass the authentication check. Keystone has stopped using the old key in production and plans to destroy all 18,835 devices in its inventory that contain it.

The company has also suspended shipment of unfulfilled orders from its official website. Sales will move to a preorder model until devices with a new authentication key are produced.

Keystone Issues Guidance for Existing Devices

Keystone explained that the authentication key is used only to verify device authenticity. It is not used to generate recovery phrases, derive private keys or sign transactions.

The company reported that the incident did not involve recovery phrases, wallet private keys or other wallet credentials. It added that customers do not need to move their assets solely because of the breach.

For devices delivered before October 20, Keystone stated that authentication remains unaffected. A device delivered before that date can be considered genuine if it passes the company’s authentication check.

Devices received after October 20 that use the old key require additional verification. Keystone cautioned that a counterfeit device could pass the existing check and directed owners to contact customer support before using it.

Lace connects to Keystone through QR codes, with transactions approved and signed on the hardware wallet. The private key remains on the device rather than appearing on an internet-connected screen.

[NEWSBREAK]

Customer Records and Data Retention

The breach involved records from purchases made through the Shopify store on Keystone’s official website. The company found that 25,964 buyer records from 2024 through 2026 still contained personal information, including names, contact details, shipping addresses and order information.

Another 25,119 buyer records had already been anonymized before the unauthorized access. Keystone also included 12,873 unpaid checkout records in its incident response because they contained information submitted by users during checkout. Purchase information from Amazon and other sales channels was not affected, according to the company.

Keystone acknowledged that some customer information had been retained beyond its previous 180-day limit because its automated deletion tool had failed to complete certain tasks. The company has shortened its retention period to 90 days and expects Shopify to complete the requested deletion of overdue data on November 3.

The company plans to notify affected customers individually and provide a page where users can check whether their information was exposed. Keystone also warned about fraudulent messages offering asset migration or requesting device returns, stating that it will not ask customers to send their devices back.