October 24 and 26, 2026: Keystone, the hardware wallet maker, said that attackers had gained unauthorised access to its official website from October 20. In an October 26 update it said that names, shipping addresses and order details for 25,964 buyers had been exposed, and that a device authentication key had been stolen, so 18,835 devices in existing stock that contain the key are being destroyed. Canonical: keystone-website-orders2026. Primary source: press coverage of Keystone's statements, including Crypto.news on the October 26 update. The company's own statement was not retrieved directly for this article.
A hardware wallet is meant to protect a user's keys even if the computer or website around it is compromised. This incident is different: it exposes buyers' personal details, and it touches a key that the website uses to check whether a device is authentic. Both problems matter, but they require different responses from buyers.
What happened
- October 20, 2026: attackers gained unauthorised access to the official Keystone website.
- October 24, 2026: Keystone's first statement was reported by Bitcoin.com, CoinSpectator and other outlets.
- October 26, 2026: Keystone's update added the counts and the key details described below.
What data was exposed
- Buyers: names, shipping addresses and order details for 25,964 buyers, covering purchases from 2024 to 2026.
- Incomplete checkouts: 12,873 records of unfinished orders also contained personal data.
- Device authentication key: a key used by the website to check whether a Keystone device is genuine was stolen.
Technical analysis
Press coverage of the October 26 update says the access came through a vulnerability in a third-party data-monitoring tool. That is a paraphrase in press coverage and has not been verified against the company's own text, so it is treated as unconfirmed here.
The authentication key matters because of how it is used. Keystone says the key cannot be erased or rewritten once it is installed on a device. It plays no role in recovery phrases, private keys or transaction signing. The risk, as described in reporting, is that a counterfeit device carrying a copy of the key could pass the website's authenticity check. That is why the company is destroying existing stock that contains the key. This article does not describe how a counterfeit device would be built.
Verified vs unverified
- Verified (company statements, as reported): the website compromise from October 20, the 25,964 buyers with exposed personal details, the 12,873 incomplete checkout records, the stolen authentication key, and the destruction of 18,835 devices in stock.
- Reported, not confirmed directly: the third-party data-monitoring tool as the entry route.
- Not known: the attacker's identity, whether the exposed data has been published, and whether any buyer has already been targeted.
Who is at risk
Buyers whose details are in the set are the most exposed, because names, addresses and order dates make a convincing phishing message. Anyone who bought a Keystone device from the website in 2024 to 2026 should treat unexpected messages about their order as suspicious. Scammers commonly offer refunds or replacements after a product recall, and that is an obvious lure here.
What to do
- Never enter your recovery phrase into a website, app or message. No legitimate wallet support process needs it, and a request for it is a sign of theft.
- Ignore refund or replacement offers that arrive by email, text or social media. Go to the official site by typing the address yourself, and check the notice there.
- Do not buy a Keystone device from a third party or a reseller until you have checked its status with the company through its official channels.
- Contact Keystone directly through its official site to ask whether your order is in the affected set, and whether your device is affected by the stock destruction.
- Watch for targeted phishing that quotes your order date, shipping address or device model. The details can be real even when the message is not.
What to watch for in the next update
Keystone has not yet published a full technical account, and the press coverage relies on its October 26 update and on paraphrase. Two open questions would change the advice here: whether the data-monitoring tool has been confirmed as the route, and whether any device carrying the key has already left the company's stock. Buyers should look for the company's own notice and treat press summaries as secondary until then.
Related reading
For another case where leaked buyer details led to a wave of phishing, see the Capcom ID leak. For a wallet-related incident where the risk was to users' keys and funds, see the Bitget wallet theft. The advice in both is the same: a legitimate service will not ask for your recovery phrase.