Keystone breach deepens: Hackers stole key used to verify wallets as genuine
Keystone initially disclosed a leak of customer information but has since disclosed that hackers also stole a key that could allow counterfeit wallets to pass authenticity checks.
Keystone, a hardware wallet maker, revealed on Monday that hackers not only accessed customer data but also stole an authentication key. This key was used to verify the authenticity of its devices, making counterfeit wallets potentially undetectable. The breach occurred after an attacker breached Keystone's website last week. The company stated that this could allow attackers to produce and sell counterfeit devices as genuine, potentially leading to asset theft.
Keystone plans to destroy 18,835 devices with the compromised key and has halted production of devices using it until new devices are produced with a new authentication key. Devices manufactured and delivered before October 20 are considered safe. However, devices shipped after that date may be at risk and customers are being urged to contact Keystone's support team for further verification.
The breach also exposed 51,083 buyer records on Keystone's Shopify store, with 25,964 records potentially stolen. The company is working with Shopify to have personal information in checkout records older than 30 days deleted. This incident follows other recent attacks on hardware wallet manufacturers, including Ledger's attack in July that exposed millions of dollars in crypto theft and Coinkite's warning about a bug in their devices that could result in theft.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
