Keystone Tells Owners to Treat Wallets Received After Oct. 20 as Risky

Keystone told owners on Tuesday that any of its wallets received after Oct. 20 "should be considered risky," a day after saying it will scrap 18,835 unsold devices.

The problem is WebAuth, an authenticity credential Keystone burns into each device at the factory to prove the hardware is genuine. The attacker behind the company's Oct. 20 website breach also obtained it, Keystone said in a statement on X on Monday. A copy could let a counterfeiter build a fake that passes Keystone's check.

It can't be erased or rewritten after manufacturing. So Keystone is scrapping its stock, moving production to a fresh credential and holding unsent web orders, Unchained reported.

What owners should do

Devices delivered before Oct. 20 can be trusted if they pass authentication, Keystone said. For devices received after that date that still carry the old credential, it said it can't rule out a counterfeit even when the check passes, and it asked owners to contact support before using them. "If you receive your Keystone after Oct 20, it should be considered risky," the company wrote on X.

WebAuth plays no part in recovery phrases or transaction signing, Keystone said. It added that it will never ask owners to ship a device back for a "recall."

Data kept too long

The breach exposed 25,964 buyer records from 2024 to 2026, plus 12,873 unpaid checkout records. Keystone said a faulty deletion tool kept some data past its 180-day limit. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure," it said. It is cutting retention to 90 days.

In our opinion: the date on the delivery slip now matters more than the check on the screen. Anyone unsure should call support before moving funds onto a post-Oct. 20 device.