Keystone to Destroy 18,835 Crypto Wallets After Hack

The manufacturer of hardware crypto wallets Keystone announced on October 26, 2026 the destruction of 18,835 unsold devices. Added to this is the suspension of shipments after its site was hacked on October 20. According to Keystone, the crypto hacker obtained a key that would allow counterfeit devices to pass the brand’s authenticity checks as well as 25,964 buyer records.

What happened during the Keystone hack?

A crypto hacker accessed the Keystone site on October 20, 2026 through a vulnerability in a third-party data tracking tool. The intrusion exposed 25,964 buyer records covering 2024 to 2026:

• names ;
• contact details ;
• delivery addresses ;
• order information.

Keystone adds that 12,873 unpaid order records may have been affected. Adding the two figures, there are up to 38,837 records concerned by this crypto hack. The company firmly asserts that recovery phrases were not exposed. The same goes for private keys and crypto wallet IDs. However, this claim has not been confirmed by an independent source.

Why is Keystone destroying 18,835 unsold crypto wallets?

Keystone is destroying 18,835 unsold crypto wallets because the exposed authenticity key is integrated into each device during production. It therefore cannot be modified. An authenticity key is a secret identifier engraved in the device, which online checks verify to confirm its origin. With it, counterfeit devices could pass for authentic.

The 18,835 crypto wallets have not yet been sold. This allows Keystone to remove them before they reach customers. At this stage, Keystone does not specify whether counterfeit devices are already in circulation.

Regarding data retention, Keystone admits a failure. An automatic deletion tool indeed broke down without the company detecting it, thus leaving records beyond the 180-day limit.

We did not fulfill our commitment to delete customer data on time, and we take responsibility for this failure.

Keystone, hardware wallet manufacturer, post on X, October 26, 2026 (translated from English)

Item	Volume	Status according to Keystone
Buyer records (2024 to 2026)	25,964	Exposed: names, contact details, addresses, orders
Unpaid order records	12,873	May have been affected
Authenticity key	1 key, unmodifiable	Exposed
Recovery phrases, private keys	Not specified	Not exposed

What does this crypto incident change for a buyer in France?

According to Keystone, crypto wallets delivered before October 20, 2026 remain safe if they pass authentication. Customers who received after this date a device equipped with the old key must however have it checked before any use. Keystone adds that users also do not need to move their funds solely because of this intrusion.

The company also commits to replace the authenticity key in new crypto wallets. And not only that! It will switch the site’s sales to preorders and reduce customer data retention to 90 days, compared to 180 days today (i.e. half as much).

Good to know: another manufacturer, Foundation, reported the day before a distinct breach. The company recorded more than 23,000 crypto phishing attempts from addresses that seemed official. It found no evidence of compromise of Passport devices nor private keys. Old database copies escaped its 60-day deletion: about 5,600 postal addresses and 5,200 phone numbers are accessible, without Foundation being able to confirm how many were accessed.

Both crypto hacks primarily affect sales data, with Keystone also having an authenticity key exposed. Moreover, a planned deletion did not occur in either case. It remains to be seen whether counterfeit devices carrying the old key will appear and if Keystone will detail its investigation, with no date announced yet. For a buyer in any case, the challenge in the coming weeks will be to verify the authenticity of a new crypto wallet with its manufacturer or an official reseller.