Keystone pauses website-order shipments after verification-key theft

Keystone has paused shipments of orders from its website until wallets with a new device-verification key are ready. In an October 26 statement covered by The Hacker News, the hardware-wallet company said an attacker had stolen the key used to prove its devices are genuine.

Keystone detected the unauthorized access on October 20 and first disclosed the breach on October 24 as a theft of customer shipping information. The company says it blocked the attacker on October 20 and later fixed the vulnerability, but it has not said when the intrusion began.

What the stolen key can—and cannot—do

The verification key serves a different purpose from owners’ wallet private keys and recovery phrases, which control or restore access to their cryptocurrency. Keystone says those private keys and phrases were not involved in the breach. The stolen key is used only to check a device’s authenticity; it does not generate wallet private keys or recovery phrases, or sign cryptocurrency transactions.

During the check, an owner scans a QR code from Keystone’s verification page with the wallet, then enters the code displayed by the device. The device uses its stored key to decrypt the QR code. A correct response therefore proves that the device holds the key—not necessarily that Keystone made it, once someone else has copied that key.

Keystone says a counterfeit carrying the stolen key could pass the check and potentially lead to cryptocurrency theft. The company has not reported any counterfeit devices or resulting thefts.

Keystone plans to destroy 18,835 unsold devices carrying the compromised key and put a replacement key in new devices. The key is installed during manufacturing in memory that can be written only once, so existing devices cannot be switched to the new key.

What owners should do

Keystone’s guidance depends on when a device arrived, not where it was bought. It also applies to wallets purchased through Amazon or authorized resellers.

• Delivered before October 20: Keystone says a device that passes its authenticity check can be used normally.
• Received after October 20 with the old key: Do not use the device until Keystone support, at support@keyst.one, confirms it is genuine—even if it passes the online check.
• Already holding cryptocurrency: Keystone says owners do not need to move it solely because of this incident. Owners whose devices arrived after October 20 with the old key should still seek support confirmation.

Keystone has not explained how owners can identify which key their device carries. As of October 27, its verification page also lacked the instructions the company had directed affected owners to follow. It has not specified what owners who already sent cryptocurrency to a later-arriving device with the old key should do, or whether old-key devices remain on sale through other sellers.

Keystone warns that messages offering refunds, replacements, recalls, wallet verification or help moving cryptocurrency are scams. It says it will not ask owners to return a device. Owners should never enter a recovery phrase into a device they did not order and should type keyst.one into their browser rather than follow links.

Which customer records are involved

Keystone says the attacker exploited a flaw in a third-party website data-monitoring tool to gain greater access and obtain customer data as well as the verification key. The affected purchase records came from its website, whose store runs on Shopify.

Keystone says payment-card details, bank details and government ID numbers were not involved. Purchase records from Amazon and its other sales channels were also unaffected.

Failed deletions and the November 3 target

Some exposed shipping information should already have been deleted under Keystone’s promise to erase it 180 days after each order. Its automated bulk-deletion tool did not work reliably, and the company failed to detect some unsuccessful deletions in time.

Keystone announced an immediate reduction in personal-data retention from 180 days to 90 days. Its published privacy policy still listed 180 days as of October 27, leaving a discrepancy between the announcement and the policy.

The company is emailing affected customers and plans a page where people can check whether their information was affected. It has asked Shopify to delete buyers’ personal data older than 90 days and expects that deletion to be completed on November 3.