Keystone breach exposed 25,964 purchase records and device key; company to destroy 18,835 unsold wallets

Keystone said attackers obtained a device-authentication key in a website breach, potentially allowing counterfeit wallets to pass its online authenticity checks. The incident exposed 25,964 purchase records and 12,873 incomplete checkout records; Keystone said seed phrases, private keys and transaction signing were not compromised ^[1].

The company plans to destroy 18,835 unsold devices tied to the old key, pause unshipped orders and use a replacement key for new production. Owners who received old-key devices after Oct. 20 should perform additional authenticity checks, even if the devices pass online verification, according to Keystone’s guidance reported by The Defiant and Phemex ^{[1] [2] [3] [4]}.

Keystone also reduced its customer-data retention period from 180 days to 90 days, according to Phemex ^[5].