Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve
An attacker gained unauthorized access to Keystone's website, obtaining the device verification key used by the company's hardware wallets. This key allows someone to build counterfeit devices that pass online checks, potentially leading to crypto theft. The breach was discovered on October 20. Keystone has instructed owners of devices received after that date with the old key to contact support and use the device only after confirmation of its genuineness.
Devices purchased before October 20 can be used normally if they pass the check. The company has destroyed 18,835 unsold devices carrying the key and will equip all new devices with a new one. Keystone found the unauthorized access on October 20 and has fixed the vulnerability, though the specific location where the key was stored remains undisclosed.
The key is used solely for the verification process and does not impact recovery phrases, private keys, or transaction signing. As of October 27, Keystone's privacy policy still stated that it retains customer data for 180 days.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
