Keystone Destroys 18,835 Wallets After Verification Key Stolen via Third-Party Monitoring Tool Exploit
Keystone lost its device verification key after a third-party tool allowed privilege escalation on its Shopify storefront. The company is destroying 18,835 units because the key cannot be erased from already-manufactured devices. The breach also exposed 25,964 customer records whose scheduled deletion had not occurred.
The breach exposed the single key burned into every Keystone device during manufacturing for the QR-code authenticity check. Because the key resides in one-time-programmable memory and cannot be overwritten, the entire batch of unsold units must be scrapped. Customer shipping records for 25,964 orders between 2024 and 2026 were also taken; the company had failed to enforce its own 180-day deletion policy due to a broken bulk-erasure script.
The incident reveals a structural weakness: hardware-wallet trust rests on a non-rotatable manufacturing secret stored on the vendor website rather than on the device firmware alone. Similar exposure patterns appear in Ledger’s 2020 and 2023 incidents where customer data and firmware signing materials resided in cloud environments without hardware-backed isolation. No evidence yet shows counterfeits in circulation, but the immutable key means any stolen copy remains valid indefinitely.
Keystone shortened data retention to 90 days and requested Shopify purge older records by November 3. New devices will ship with a fresh key. The episode underscores that supply-chain integrity for cold-storage hardware depends on minimizing long-lived secrets and enforcing deletion schedules that currently lack automated verification.
Keystone Security Team: Zero confirmed counterfeit devices reported by 31 March 2027.
Sources (3)
- [1]Keystone Security Update October 2026(https://keyst.one/security-update-oct26)
- [2]The Hacker News(https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html)
- [3]Shopify Data Incident Log(https://shopify.com/security/incidents/2026)