Crypto: hackers stole the key proving a Keystone wallet is authentic, what should you do?

18,835 brand-new crypto wallets, still in their boxes, are going to end up in the shredder. That's the decision announced on October 26 by Keystone, a manufacturer of these little boxes used to keep your bitcoins offline. They're not broken, tampered with, or even scratched. They simply contain a key that hackers now know.

And that key is the one that proves that a Keystone box is genuine.

Two identical boxes, and no safe way left to tell which one came from the factory

First, the good news: your crypto is safe

A hardware wallet is a little device that keeps the secret key to your crypto and signs your payments without ever letting it out. With Keystone, you don't even plug it in: it talks to your phone through QR codes, across the screen. The day you set it up, it gives you a list of 12 or 24 words, the "recovery phrase". It's the master key to your money: whoever has those words has your crypto. That's why you write them down on paper, and not in your phone's notes, between the shopping list and the gate code.

And those words aren't affected. Keystone is categorical: the stolen key is used neither to create recovery phrases nor to sign anything. If your Keystone was delivered before October 20 and passes the authenticity check on the official verification page, you can keep using it as before. Phew.

The "genuine" stamp is in the wrong hands

So, what exactly was stolen? On October 20, someone got into Keystone's official website through a flaw in a monitoring tool provided by another company. From there, they climbed up to two treasures: the customer records from the online store, and a key called "WebAuth".

Keystone engraves this key into every box at the factory. When you check your device on the website, it's the one that answers "yes, I really came from Keystone". It's the official stamp that certifies the original. And with that stamp in their pocket, a counterfeiter can make a modified box that passes the check without a fuss. A booby-trapped box, sold on a small online shop or a marketplace, that would send your recovery phrase to its maker instead of keeping it.

With the official stamp, any fake can pass itself off as the original

Why destroy 18,835 brand-new boxes?

Because the key is engraved for good. It can't be erased or rewritten, that's precisely what made it reliable. All the devices in stock therefore carry a key that the hackers know. Selling them anyway would mean mixing genuine devices with future fakes that had exactly the same signature. Nobody could tell the difference anymore.

Keystone therefore chose the strong-arm approach: the shredder for the entire stock, deliveries suspended for orders from the website that hadn't left yet, and switching to pre-orders until new boxes come out of the factory with a new key. It hurts the wallet, the real one, the company's. But it's exactly the right decision, and plenty of companies would have preferred to clear the stock while crossing their fingers.

18,835 boxes that did nothing wrong, but carry the wrong key

For devices delivered after October 20, Keystone asks you to contact its support team before using them. The check on the website is no longer enough, since a fake would pass it too.

The leak that should never have existed

The second haul is the customers. According to Keystone, 25,964 buyer records from the site, between 2024 and 2026: name, contact details, delivery address and order details. Plus 12,873 abandoned carts with name and address. No bank card, no ID. Purchases made on Amazon or from other retailers are not affected.

And that's where Keystone admits something that made my teeth grind. These records should no longer have existed: the house rule was to delete them after 180 days. An automatic tool was supposed to handle it, it crashed from time to time, and nobody noticed. The result was data that should have disappeared months ago still sleeping on the server on the day of the burglary. Keystone requested deletion from its online shop platform, expected by November 3, and is switching to 90 days of retention. With this message, in its statement: “We owe you an apology.”

Why is an address serious, then? Because in crypto, a list of wallet buyers is a list of people who probably have crypto at home. In 2020, the addresses of more than 270,000 customers of Ledger, the French competitor, were published on the Internet, and some received months of scams, fake packages and even threats. I talked about it in early September with the Trezor customer leak: it's always the same mechanism, and scammers have a memory.

The kind of letter that will arrive at Keystone customers' homes, and end up in the trash

If you have a Keystone, or if you were planning to buy one

Three reflexes, and the last two apply to all brands:

• your Keystone arrived before October 20 and passes verification: nothing changes ; if it arrived after, support first, as explained above ;
• you receive an email, an SMS or a letter talking about a “product recall”, “migration of your funds” or “verification of your wallet”: it's a scam, Keystone says in black and white that it will never ask you to send your device back ;
• and whatever the brand, you only buy a hardware wallet from the manufacturer's site or from an official reseller, never second-hand, never on a marketplace where anyone can sell.

And the golden rule, the only one that really protects you: nobody, ever, needs your 12 or 24 words. Not support, not a technician, not a “security” form. The day someone asks you for them, you have your answer.

For me, Keystone comes out with honors in its crisis management: transparency, apologies, destroyed stock. On data retention, on the other hand, it's a red card, because a customer file deleted on time is a file that can't be stolen. And to whoever now has the official stamp in their pocket: good luck selling your fakes, everyone knows now!

Sources

• Keystone on X, October 26, 2026: the full statement on the stolen key and the 18,835 devices
• Blockhead, October 27, 2026: the timeline and figures from the leak
• The Hacker News: Keystone will destroy 18,835 wallets
• crypto.news: the authentication key and advice for customers

Article written with the help of Claude Code, proofread and corrected by me.