Keystone, a maker of crypto hardware wallets, said on October 26 that an attacker who broke into its website obtained the key its wallets use to prove they are genuine. The attacker also got customer data: 25,964 buyer records with names, contact details, addresses and order details. Keystone said card, bank and ID details were not involved. It will scrap 18,835 unsold wallets holding the old key and load a fresh key into new ones.
Owners check a wallet by scanning a QR code that hides a code only the device's stored key can unlock. So anyone holding a copy of the key could build fakes that pass. Keystone said recovery phrases and private keys were not touched, and it has not reported any fakes or thefts. The key sits in write-once memory, so wallets already built cannot switch. Keystone found the breach on October 20 but did not say when it began or where the key was kept. Wallets delivered earlier that pass the check are fine, it said. For later ones with the old key, owners should wait for support to confirm.
For anyone who buys or sells hardware with built-in trust checks, one secret shared by every device is a single weak point. Here a website breach reached a promise made by the hardware.