An unauthorized access to Keystone’s website has raised security concerns, leading to the compromise of a key used for verifying the authenticity of their hardware wallets. Keystone disclosed this incident on October 26, emphasizing that while the verification key was exposed, customer recovery phrases and wallet private keys remained secure.
Impact of the Security Breach
The breach enables the possibility of counterfeit devices being produced, as the stolen key allows for the creation of devices that can falsely pass authenticity checks. Consequently, Keystone announced plans to destroy 18,835 unsold devices still containing the compromised key. Future devices will incorporate a new, secure key.
The breach was identified on October 20, and Keystone provided specific advice to its customers based on when they received their devices. Devices received after this date with the old key should not be used until Keystone confirms their authenticity. Devices delivered before October 20 that pass verification can be used without concern.
Details of the Unauthorized Access
The attack exploited a vulnerability in a third-party data monitoring tool used by Keystone’s website, allowing the attacker to access customer data and the verification key. Keystone blocked access on October 20 and has since resolved the vulnerability. The company has not disclosed the exact location where the key was stored.
Keystone’s verification process involves scanning a QR code with the device, which then decrypts an encrypted code using the stored key to verify its authenticity. This key is solely used for verification and does not impact recovery phrases or private keys.
Customer Data Concerns and Recommendations
Keystone initially revealed the breach on October 24, noting that customer shipping information was accessed. Affected records include 25,964 purchase details from 2024 to 2026. Payment and identification information were not compromised. In response, Keystone is reducing the data retention period from 180 to 90 days and is working with Shopify to ensure the deletion of outdated data by November 3.
Customers have been advised to verify their devices and contact Keystone support if needed. For those waiting on orders, shipping will resume once devices with the new key are available. Keystone also warned against potential scams and emphasized that they will not request device returns or personal information through unsolicited communications.
While no counterfeit devices or thefts have been reported, Keystone urges vigilance among its users to prevent potential threats and ensure the security of their cryptocurrency.
