{"investigation":{"slug":"keystone-hardware-wallet-breach-october-2026","entity_name":"Keystone Hardware Wallet Breach (October 2026)","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Keystone, a maker of air-gapped cryptocurrency hardware wallets (formerly known as Cobo Vault), disclosed in late October 2026 that an attacker breached its Shopify-backed website, stealing customer order data and, in a more serious escalation, a cryptographic key the company uses to verify that its devices are genuine. Keystone said no seed phrases, private keys, or payment details were taken, but it could not rule out counterfeit devices among units shipped after the breach and announced it would destroy over 18,000 affected units in its own inventory. The incident also revealed that Keystone's automated data-deletion tool had failed silently for an extended period, undermining its public '180-day data deletion' promise.","sections":[{"content":"Keystone said it detected unauthorized access to its official website on October 20, 2026, and confirmed the intrusion on October 23 after reviewing API activity with its e-commerce platform, Shopify. The company publicly disclosed the breach around October 24, posting an apology on social media, and said the attacker obtained customer names, contact details, shipping addresses, and order details including items purchased and prices. Keystone said payment card and bank details, wallet passwords, private keys, and recovery phrases were not exposed. The attacker reportedly exploited a vulnerability in a third-party monitoring tool used on Keystone's website to escalate privileges and access the Shopify-connected data. Keystone said it has since blocked the attacker's access and fixed the underlying vulnerability.","heading":"Website Breach and Customer Data Exposure","sources":[{"url":"https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613","name":"Keystone customers say breach exposed data the hardware wallet maker promised to delete","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","name":"Keystone to destroy 18,835 hardware wallets","type":"news_article","credibility":2}],"severity":"high"},{"content":"In an expanded statement on October 26, 2026, Keystone said the same attacker also obtained a cryptographic key the company uses to verify, via its online device-authentication page, whether a hardware wallet is genuine. Because this key is written into devices at the point of manufacture and cannot be erased or rewritten, Keystone said it could not rule out that counterfeit devices built with the stolen key could pass its authenticity checks. Keystone stated directly: 'Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit.' The company said devices delivered before October 20, 2026 that pass the authenticity check can still be considered genuine, but devices received after that date carrying the compromised key cannot be guaranteed authentic and should not be used until Keystone support confirms their legitimacy. Keystone said it would destroy 18,835 unsold devices in its inventory that contain the compromised key, suspend shipments of devices using that key, and transition to a new authentication key for future production. Keystone maintained that the stolen key does not expose private keys or seed phrases, which it said remain protected by a secure chip inside each device.","heading":"Device Authentication Key Theft and Counterfeit Risk","sources":[{"url":"https://cointelegraph.com/news/keystone-breach-deepens-hackers-stole-key-used-to-verify-wallets-as-genuine","name":"Keystone breach deepens: Hackers stole key used to verify wallets as genuine","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","name":"Keystone to destroy 18,835 hardware wallets","type":"news_article","credibility":2},{"url":"https://www.bankless.com/read/news/keystone-breach-widens-as-attacker-grabs-its-device-authentication-key","name":"Keystone breach widens as attacker grabs its device authentication key","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Keystone had publicly promised customers, including in posts dated January, March and August, that shipping and order data would be 'permanently deleted' or automatically erased 180 days after purchase, stating that 'other hardware wallets keep your data forever' while Keystone did not. Following the breach, Keystone acknowledged that the automated tool meant to enforce this 180-day deletion policy had not operated reliably, and the failure went undetected for an extended period, allowing years of old buyer records to remain exposed. Several affected customers reported online that they had placed orders many months or years before the breach yet still received breach notifications, consistent with the deletion failure. Keystone's formal privacy policy, last updated in May 2021, described the retention rule in narrower terms than its marketing posts, and as of late October 2026 the company had not publicly clarified whether it had in fact complied with its own stated policy. In response to the breach, Keystone said it shortened its retention window from 180 to 90 days and, on October 24, 2026, asked Shopify to purge overdue buyer data, with completion expected by November 3, 2026.","heading":"Data Retention Failures and Privacy Policy Discrepancies","sources":[{"url":"https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613","name":"Keystone customers say breach exposed data the hardware wallet maker promised to delete","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","name":"Keystone to destroy 18,835 hardware wallets","type":"news_article","credibility":2}],"severity":"medium"},{"content":"News outlets reported differing figures for the scale of the breach, and Keystone's own disclosures did not fully reconcile the numbers. One account, attributed to Keystone's own statement, said its Shopify store had generated 51,083 total buyer records, of which 25,119 had already been deleted under the retention policy, leaving approximately 25,964 records from 2024–2026 purchases as potentially affected. Separately, outlets reported that the attacker may also have accessed 12,873 additional incomplete checkout records retained by Shopify, which Keystone included in its notification out of caution even though these were not completed purchases. Because these figures come from secondary reporting rather than a single verified primary statement obtained directly by this investigation, the exact total number of affected individuals should be treated as approximate and alleged pending a consolidated account from Keystone.","heading":"Conflicting Scope Estimates","sources":[{"url":"https://cointelegraph.com/news/keystone-breach-deepens-hackers-stole-key-used-to-verify-wallets-as-genuine","name":"Keystone breach deepens: Hackers stole key used to verify wallets as genuine","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","name":"Keystone to destroy 18,835 hardware wallets","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Keystone's public response included blocking the attacker's access, fixing the exploited vulnerability, emailing affected customers, shortening its data retention window, destroying the 18,835 devices carrying the compromised authentication key, suspending shipments of affected devices pending a new authentication key, and pledging a more detailed incident report. Keystone also warned customers that scammers might impersonate the company by phone, text, email or mail, including offers to 'recall,' refund, replace or help migrate assets from a device, and said it would never initiate such contact; it advised customers to type its domain directly into a browser rather than clicking unsolicited links and never to enter a recovery phrase into a device they did not personally order. Keystone said owners do not need to move funds solely because of this incident, since it maintains the compromised key does not itself expose private keys or seed phrases. As of the most recent reporting reviewed, Keystone had not disclosed how the attacker initially gained entry beyond the third-party monitoring tool vulnerability, nor had it identified the attacker.","heading":"Company Response, Remediation and Scam Warnings","sources":[{"url":"https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613","name":"Keystone customers say breach exposed data the hardware wallet maker promised to delete","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","name":"Keystone to destroy 18,835 hardware wallets","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2026-10","event":"Keystone detects unauthorized access to its website.","source":"The Block","source_url":"https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613","date_evidence":"Oct. 20: Keystone \"detected unauthorized access to its official website.\"","date_original":"2026-10-20"},{"date":"2026-10","event":"Keystone confirms the breach after reviewing Shopify API activity.","source":"The Block","source_url":"https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613","date_evidence":"Oct. 23: Keystone confirmed the breach \"after verifying API activity with Shopify.\"","date_original":"2026-10-23"},{"date":"2026-10-24","event":"Keystone publicly discloses the breach, apologizes, and says customer shipping information was accessed.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","date_evidence":"October 24, 2026, when Keystone Hardware Wallet posted an apology on X."},{"date":"2026-10","event":"Keystone requests that Shopify purge overdue buyer data and shortens its retention window to 90 days, with purge expected to complete by November 3.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","date_original":"2026-10-24"},{"date":"2026-10-25","event":"The Block reports customer accounts of the breach and questions over Keystone's compliance with its 180-day deletion promise.","source":"The Block","source_url":"https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613","date_evidence":"article published 2026-10-25"},{"date":"2026-10","event":"Keystone discloses that the attacker also stole its device-authentication key and announces plans to destroy 18,835 affected devices.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","date_evidence":"the company said in a statement on October 26","date_original":"2026-10-26"},{"date":"2026-11","event":"Shopify is expected to complete deletion of Keystone buyer data older than the new 90-day retention window.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html"}],"sources_used":[{"url":"https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613","name":"Keystone customers say breach exposed data the hardware wallet maker promised to delete","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/keystone-breach-deepens-hackers-stole-key-used-to-verify-wallets-as-genuine","name":"Keystone breach deepens: Hackers stole key used to verify wallets as genuine","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html","name":"Keystone to destroy 18,835 hardware wallets","type":"news_article","credibility":2},{"url":"https://www.bankless.com/read/news/keystone-breach-widens-as-attacker-grabs-its-device-authentication-key","name":"Keystone breach widens as attacker grabs its device authentication key","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-31T20:20:48.911464+00:00","updated_at":"2026-10-31T20:20:53.844+00:00"},"source_quality":{"total":4,"tier1":0,"tier2":2,"tier3":0,"unrated":2},"follower_count":null,"content_updated_at":"2026-10-31T20:20:49.270Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}