Keystone's Device Authentication Key Was Stolen: Passing the Genuineness Check No Longer Proves a Device Is Real

On October 26, hardware wallet maker Keystone published a full statement. An attacker exploited a vulnerability in a third-party data monitoring tool used by its website to escalate privileges, taking about 26,000 buyer records with names, contact details and shipping addresses, about 13,000 unpaid checkout records, and the key its website uses to verify whether a device is genuine.

That key is written into devices at manufacturing and cannot be changed, so whoever holds it can build counterfeits that pass the official check. Keystone has retired the old key, will destroy 18,835 inventory units that carry it, and has paused shipping from its website. It says recovery phrases, private keys and the firmware signing key were not affected, that devices received after October 20 should be re-verified with support even if they pass the check, and that it will never ask customers to ship devices back. The same day, fellow hardware wallet maker Foundation said phishing emails had been sent from its official domain after cloud API keys were exposed.

Where small teams are exposed

Five things you can do now

• Inventory every signing device the team uses: brand, purchase channel and delivery date. Stop using Keystone units delivered after October 20 for new wallets and verify them with support as Keystone advises
• Never use a device you did not order, including anything labeled a "replacement" or "recall," and never ship a device back to anyone
• Treat vendor emails as untrusted even from the official domain. Do not click their links; type the vendor's address yourself
• Buy signing devices through one company channel, ship them to the office, and have two people verify and log each one on arrival
• Keep larger funds in multisig and spread signing devices across brands, so one bad device cannot reach the whole treasury

The sequence of events follows Keystone's official statement. Foundation's phishing email counts come from media reports; the number of affected users has not been published. This article does not cover attack details.