Keystone go Destroy 18,835 Wallets After Dem Thief Device Authentication Key

Keystone plan to destroy 18,835 unsold hardware wallets after attacker collect one key wey dem dey use verify whether dem devices na original. Di company reveal di bigger scope of di incident on October 26, include access to customer information from im online store.

Keystone dey support several Cardano wallets, include Lace and Eternl. Lace add Keystone support for August, allow users to manage Cardano assets while dem dey approve transactions on di hardware device.

Website Breach Exposes Device Verification Key

Keystone detect unusual access to im official website on October 20. Dem investigation find say di attacker exploit one vulnerability for third party data monitoring tool wey di site dey use, take gain elevated privileges and access to customer information and di device authentication key.

Di affected WebAuth key dey written inside devices during manufacturing and person no fit erase or replace am. Keystone dey use am to verify whether device na genuine through im authentication page.

According to di company, if person hold di key, e fit allow attacker create counterfeit devices wey go pass di authentication check. Keystone don stop to use di old key for production and plan to destroy all 18,835 devices for im inventory wey get am.

Di company don also suspend shipment of unfulfilled orders from im official website. Sales go move go preorder model until dem produce devices wey get new authentication key.

Keystone Issues Guidance for Existing Devices

Keystone explain say di authentication key na only to verify device authenticity. Dem no dey use am to generate recovery phrases, derive private keys or sign transactions.

Di company report say di incident no involve recovery phrases, wallet private keys or other wallet credentials. Dem add say customers no need to move their assets just because of di breach.

For devices wey dem deliver before October 20, Keystone talk say authentication remain unaffected. Device wey dem deliver before that date fit count as genuine if e pass di company authentication check.

Devices wey receive after October 20 wey dey use di old key need extra verification. Keystone warn say counterfeit device fit pass di existing check and direct owners make dem contact customer support before dem use am.

Lace dey connect to Keystone through QR codes, with transactions wey dem approve and sign for di hardware wallet. Di private key remain for di device, e no dey show for internet connected screen.

[NEWSBREAK]

Customer Records and Data Retention

Di breach involve records from purchases wey people make through di Shopify store for Keystone official website. Di company find say 25,964 buyer records from 2024 through 2026 still get personal information, include names, contact details, shipping addresses and order information.

Another 25,119 buyer records don already anonymize before di unauthorized access. Keystone also include 12,873 unpaid checkout records for im incident response because dem contain information wey users submit during checkout. Purchase information from Amazon and other sales channels no dey affected, according to di company.

Keystone acknowledge say some customer information stay pass di previous 180 day limit because im automated deletion tool fail complete some tasks. Di company don shorten im retention period to 90 days and expect Shopify to complete di requested deletion of overdue data on November 3.

Di company plan to notify affected customers one by one and provide one page wey users fit use check whether their information expose. Keystone also warn about fraudulent messages wey dey offer asset migration or dey request device returns, talk say dem no go ask customers to send their devices back.