Keystone Will Destroy 18,835 Hardware Wallets: A Website Breach Leaked Its Authenticity Key
A company that sells wallets is about to physically destroy nearly twenty thousand of its own wallets because its website got hacked.
Three key facts
Keystone says it will destroy 18,835 unsold devices and suspend shipments. According to CoinDesk, an attacker got into the company's website on October 20 through a flaw in a third-party data monitoring tool. What leaked included a key burned into devices at production that cannot be changed — it affects whether a wallet passes online authenticity checks, meaning counterfeit devices could be accepted as genuine.
Customer data leaked too. The incident exposed 25,964 buyer records from 2024 through 2026, including names, contact details, shipping addresses, and order information; another 12,873 unpaid checkout records may also be affected. Keystone admitted some records should have been deleted under its 180-day retention policy, but an automated deletion tool failed without the company noticing.
This isn't isolated — it's systemic fragility across one supply chain. The report notes hardware wallet users have been hit repeatedly this year: Ledger devices sold through a Southeast Asian reseller were fitted with hidden components that captured recovery phrases during setup; a flaw in Coldcard's seed-generation software let attackers reconstruct private keys and drain wallets remotely. Keystone stresses this breach did not expose recovery phrases, private keys, or wallet credentials, and that devices shipped before October 20 remain safe.
Wang Dou's Take
Start with the strangest part: what broke was "the website"; what gets destroyed is "the devices." Between those two lies the entire production chain — and somewhere on it sits a key burned in at manufacturing that can never be changed. That means there is no "patch it" option here, only "scrap and start over." Hardware security is cruel like this: software can be hot-fixed; trust baked into silicon can only be physically destroyed.
The second thing to remember is that 180-day deletion promise. It wasn't breached — it "failed silently, and nobody noticed." The automated deletion tool quietly died and the company didn't know. That kind of failure is scarier than being hacked, because it raises no alarm. You write a rule, drop it into a running script, and then assume it's been executing. That's the soft spot of every compliance promise: the promise lives on paper, execution rides on automation, and nobody watches the automation.
The third is this year's pattern. Ledger fell at the reseller, Coldcard fell in the code, Keystone fell at the website — three companies, three completely different links, all compromised. That tells you "buying a hardware wallet = being safe" is an oversimplification: what you buy isn't a secure slab of metal, it's an entire chain — production, firmware, distribution, website, support database — and your security equals the weakest link. Today's weakest link was a data monitoring tool the company outsourced to a third party.
Source: CoinDesk · Keystone Statement