Keystone Hardware Wallet on X: "Statement Regarding the Security Incident on Our Official Website and Customer Guidance" / X
We recently confirmed a security incident involving the Keystone official website. We understand that this may raise concerns about the security of your personal information and devices. We sincerely apologize for this incident. Below, we explain the confirmed impact, the actions you should take, and the steps we are taking to address the situation.
This incident did not involve your recovery phrase, wallet private keys, or other wallet credentials. It also did not involve bank payment information or government-issued identification numbers.
****1. Incident Overview****
On October 20, 2026, our security monitoring systems detected unusual access to the official website. We immediately disabled sensitive website functions that could potentially expose users to attacks and blocked the relevant unauthorized access points on the same day. We also fixed the vulnerability and launched a forensic investigation and additional security measures.
Our investigation found that the attacker exploited a vulnerability in a third-party data monitoring tool used by our website to escalate privileges. This enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices.
****2. Scope of Impact****
****(1) Affected buyer records: 25,964****
Our investigation found that the incident involved 51,083 buyer records generated by purchases made through the Shopify store on our official website. These records were stored and managed by Shopify. Customer purchase information from Amazon and other sales channels was not affected.
Of these records, the personal information associated with 25,119 had already been permanently erased from Shopify before the unauthorized access, in accordance with our data retention policy. The associated order information had been anonymized and no longer contained personally identifiable information such as names, contact details, or shipping addresses.
The remaining 25,964 records still contained personal information, covering the period from 2024 to 2026. This information included names, contact details, shipping addresses, and order information.
Under our data retention policy, buyer records should be erased after 180 days. Because erasure through the Shopify backend requires manual processing of individual records, which is inefficient, we developed an automated tool to handle bulk erasure. However, the tool did not operate reliably. Some erasure tasks failed, and we did not detect and address these failures in time, resulting in certain personal information being retained beyond the permitted period.
This exposed shortcomings in the design and operational monitoring of our data processing procedures. We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure.
Progress on erasing overdue data: We have improved our erasure procedures and, on October 24, 2026, submitted requests to Shopify to erase all buyer personal data that had exceeded the 90-day retention period. Under Shopify's rules, the requests require a 10-day waiting period before the erasure is finalized, meaning completion is expected on November 3, 2026. We will update this announcement with the results once the erasure is complete.
****(2) Unpaid customer checkout records: 12,873****
We also discovered that Shopify had recorded 12,873 checkout records for which payment was not completed.
These records were not completed purchase orders, but they contained names, contact details, and shipping information submitted by users. Although some of this information may have been incomplete or inaccurate, we have included these records in our incident response as a precaution.
On October 24, 2026, we submitted requests to Shopify to erase personal data in checkout records retained for more than 30 days. We will also notify these users of the potential risks by email.
****(3) Device authentication key****
Our investigation confirmed that the attacker also obtained the WebAuth key we use to verify whether a device is genuine through our device authentication page:
https://keyst.one/authentication/
This key is written into devices during manufacturing and cannot be erased or rewritten. It is used exclusively to verify device authenticity during the WebAuth process. It is not involved in recovery phrase generation, private key derivation, or transaction signing.
The key forms the foundation of trust for our device authentication mechanism. If it is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks. These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft.
In response, we are making comprehensive changes to our manufacturing, inventory, and shipping arrangements:
- Effective immediately, production will stop using the old key. All newly manufactured devices will use a new authentication key.
- The 18,835 devices in existing inventory that contain the old key will be destroyed. They will not be sold or shipped to customers.
- Shipping of all unshipped orders from our official website has been suspended. Sales will switch to a preorder model until production of devices using the new key is complete, after which shipping will resume.
****3. Answers to Your Concerns****
****(1) Your Assets and Recovery Phrase****
This incident did not involve recovery phrases, private keys, or other wallet credentials. You do not need to transfer your assets solely because of this incident.
Please be vigilant against calls or messages claiming to offer “asset migration,” “wallet verification,” or “investigation assistance.” Do not trust such claims or take any hasty actions involving your wallet.
****(2) Your device****
The guidance below is based on October 20, 2026, the date we discovered the unauthorized access.
Devices delivered before October 20, 2026
These devices were manufactured and delivered before the incident. Their authentication functionality is unaffected. If a device passes authentication, it can be considered genuine and used normally.
Devices received after October 20, 2026 that use the old authentication key
Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit. Please follow the instructions on the device authentication page to contact customer support for additional verification. Only use the device after its authenticity has been confirmed.
We will not ask you to return your device. Anyone contacting you under the pretext of a “recall” and asking you to ship your device to them should be treated as a scammer.
****4. Our Next Steps****
- Follow up with Shopify to ensure the overdue order data is erased, and implement multiple safeguards to ensure that any future overdue data is reliably erased.
- Effective immediately, the customer personal information retention period will be shortened from 180 days to 90 days.
- Notify affected customers individually by email and provide customer support.
- Launch a data breach lookup page in due course, allowing users to check whether their personal information was affected.
- Launch a status lookup page in the future, allowing users to check whether their personal information has been erased.
- Destroy the 18,835 devices in existing inventory that use the old authentication key and suspend shipping until production of devices using the new key is complete.
- Conduct a security audit, review the effectiveness of the vulnerability fixes, and continue strengthening data access controls and key management.
- Fulfill reporting obligations to regulatory authorities or law enforcement agencies in relevant jurisdictions, as required by applicable regulations. Reports have already been submitted in the EU, UK, and other jurisdictions.
****5. Official Reporting Channels****
If you receive suspicious messages, phone calls, or URLs, please report them to us through our official channels.
- Official website:https://keyst.one
- Official customer support email: support@keyst.one
Please enter the domain manually rather than clicking unfamiliar links.
This incident has caused concern and inconvenience and has damaged your trust in Keystone. We sincerely apologize. We will continue supporting affected customers, verifying device authenticity, confirming data erasure results, and improving our data protection practices and device authentication key management.
Rebuilding trust takes time and requires concrete action. We will continue publishing updates through our official channels so that you can follow our response and assess the improvements we make.
Keystone
October 26, 2026