Keystone has great news for you: the company swears nobody touched your seed phrases. The bad news: it lost the master key it used to prove its wallets are genuine, handed the home addresses of tens of thousands of its customers to the attackers — and now, with a perfectly straight face, asks you to take its word that everything else is safely under lock and key.
On October 26, Keystone published its breach disclosure. By the company’s own account, on October 20 it noticed intruders on its official website: the attacker got in through a hole in a third-party data-monitoring tool, escalated privileges and walked off with two trophies — the customer database with shipping addresses and the WebAuth cryptographic key Keystone uses to certify that every one of its wallets is authentic.
Who exactly came calling, which third-party tool was breached and how many weeks or months the intruders made themselves at home before October 20, the report does not say. What the company does report, with some pride, is how many of its own devices now have to go under the industrial press: 18,835 of them. Warehouse shipments have stopped, yet preorders for a future batch with a “new key” opened right away — you are only asked to wait four to six weeks. And, naturally, to enter your home address once again.
The engineering irony deserves special admiration. For years Keystone sold itself as the gold standard of “100% air-gapped” security: no Bluetooth, no Wi-Fi, no data over USB — only a camera and QR codes, so the wallet never, ever touches the internet. They heroically cut the cable from the device, then bolted a third-party tracker onto their website, and an attacker off the street used it to reach the crown secret of the factory verification. It must have been a very important metric they were monitoring.
1. What this “master key” is and why the whole warehouse is going into the shredder
Keystone’s authenticity check is simple. When you first switch the device on, you go to the official verification page, the site shows a QR code, you scan it with the wallet’s camera, the wallet returns a string of digits, and you type them back into the site. If they match, the screen congratulates you on owning a “genuine” device.
Open the Keystone 3 firmware source code and look behind the curtain. The QR code carries a challenge value encrypted with RSA and signed with a Keystone key. The wallet checks the signature and decrypts the challenge with a private RSA key. At the factory, that key is burned into one-time programmable (OTP) memory — the stock firmware will not let it be overwritten.
In other words, the whole “authenticity check” proves exactly one fact: the gadget in your hands knows a secret. Not “the board was assembled at Keystone’s factory”, not “there is no extra chip inside”, not “the random number generator is honest”. Only “it knows the secret”. The very secret that, by the company’s own admission, is now in the attackers’ hands. The verification page itself keeps working like clockwork — it is just that any counterfeit can now light up that coveted green checkmark.
In its press release Keystone hurries to reassure the public: the stolen key plays no part in generating seed phrases, deriving private keys or signing transactions. Technically, that is the plain truth — except that this is precisely the key that convinced buyers it was safe to enter a seed phrase into the box at all. A mere trifle.
Even more interesting is a detail that surfaced in the description of the replacement: all 18,835 warehouse wallets carry the “old” key, while the next batch will get a “new” one. That leads to a lovely architectural conclusion: instead of individual certificates for each device, Keystone appears to have stamped one shared secret onto an entire batch. The penny-pinching turned out exemplary: once a single key leaks, there are no specific serial numbers to revoke — the entire warehouse goes under the knife.
What is more, the site only needed the public half of the key to generate the verification QR code. Yet the private half, without which nobody can answer the check on a device’s behalf, apparently lived comfortably somewhere reachable through the web server. Keeping the master key to the factory seal under the online store’s doormat is a whole new chapter in cryptography.
2. What can now be done with this key
Keystone describes the main attack scenario itself: with the leaked secret in hand, criminals can churn out fake wallets that sail through the official authenticity check on the website, sell them through resellers or second hand — and drain buyers’ balances. No counterfeits caught in the wild have been reported so far.
To rob the owner, a fake needs neither the original Keystone firmware nor the factory code-signing key (which, the company swears, was not affected). Inside a look-alike plastic case can sit any cheap board that, during setup, hands you a 24-word seed phrase the thieves prepared in advance. The stolen OTP secret serves this decoy for exactly one purpose — to answer the first QR code correctly and soothe a vigilant buyer with the words “Verification Successful”.
That is why 18,835 finished wallets are headed for the scrapyard. Their memory is one-time programmable — the key cannot be updated remotely. Telling a genuine wallet with the “old” key apart from a homemade replica with the same key through the website is now impossible too. In the end, the only “key rotation” tool the design provides turned out to be an industrial shredder. Keystone grandly calls destroying the batch “a costly but right decision” — when in reality its own architecture simply left it no other choice.
3. A man with a knife by the bed: who appointed the breached company as guarantor?
Let us look at Keystone’s official recommendations for those who already bought a wallet:
- Received the device before October 20 and it passes verification — keep using it, there is no need to move your crypto to other wallets.
- Received a device with the old key after October 20 — do not use it until support (support@keyst.one) manually confirms it is authentic. The company itself admits it is powerless: even if such a wallet passes the check on the website, it can no longer rule out a counterfeit. How exactly buyers are supposed to tell whether an “old” or “new” key is burned into their wallet, Keystone, according to The Hacker News as of October 27, forgot to explain. What support will use in place of the compromised cryptography is also a mystery — presumably they will read fortunes from a photo of the box.
- There is no recall. Nobody is asked to return anything, and any emails or calls about “wallet replacement” or “rescuing funds” are declared a scam.
This entire rescue guide hinges on the date October 20. In replies under its own post, Keystone representatives state confidently that the key leaked on October 20. Yet the press release itself names October 20 as the day the intrusion was discovered, while the date the attacker first gained access to the system is modestly left out. Everyone whose parcel arrived on the 19th is invited to believe in a miraculous coincidence: that the hacker broke in, pulled out the database with the key and was caught red-handed all on the same day.
But the fundamental question here is even harsher: how does Keystone itself even know what was stolen and what was not?
Look at who is playing the expert in front of you. All these mantras — “the firmware signing key is safe”, “older devices are not affected”, “in a month we will ship a new, secure batch” — come from a company that has just been cleaned out through a third-party plugin on its own website. Only yesterday these people had no idea the root secret of their hardware verification was being carried out from under their noses. For two years straight they failed to notice that their script for deleting customer addresses did not work. And today the very same people, with a straight face, hand you an indulgence and undertake to guarantee which folders the hacker looked into and which ones he nobly walked past.
Whoever allowed the leak is no longer a guarantor. If they did not know about this breach yesterday, how will they know about the next one tomorrow? Where is the guarantee that the “new key”, for which they are now collecting preorders, will not slip out through yet another hole before the assembly line stamps out the first thousand boxes?
4. Two years of false promises about deletion and 13,000 people who did not even buy anything
A compromised key can at least be replaced in new hardware. Your home address cannot be reissued on preorder.
The attackers got away with 25,964 customer records from Keystone’s official Shopify store for 2024–2026: full names, phone numbers, email addresses, exact home delivery addresses, and the contents and total of every order. Along with them went another 12,873 unpaid draft orders with names, phone numbers and addresses. In other words, almost thirteen thousand people never even bought this ill-fated wallet — they simply visited the site, typed in their address to check the shipping cost, changed their minds and closed the tab. And they still ended up on a leaked list of cryptocurrency holders.
But the real low point of this story is that most of these records should never have existed in the database in the first place. Keystone officially promised customers it would delete shipping data after 180 days. People ordered hardware wallets to their home addresses, counting on the trail disappearing six months later. Once the hackers carried off the database, it suddenly emerged that the bulk-deletion tool in Shopify had been throwing errors the whole time, and nobody at the company had even checked whether a single row was being erased. Now Keystone sheepishly throws up its hands, promises to cut the retention period to 90 days and solemnly vows to delete the old archives by November 3 — right after the attackers have already downloaded them.
If a company swore for two years that it was deleting your data while in fact piling it up in a piggy bank for hackers, the trust its words deserve is exactly zero. Imagine waking up in the middle of the night to see someone close to you standing over your bed with a knife in hand. And they calmly say: “Don’t worry, I just felt like standing here with a knife. Maybe I did want to poke you, but roll over and go back to sleep — I have noted this incident, worked through it, and this particular one will never happen again.” That is roughly how Keystone’s promises to erase addresses after 90 days instead of 180 and to guard the next master key more carefully sound today.
What a leaked database means in practice hardly needs explaining. It is a ready-made address register of people who are guaranteed to have something worth taking at home — complete with full names, phone numbers and apartment numbers. For phone scammers, it is a call backed by real order details: one buyer has already posted in Keystone’s thread that fraudsters called him and addressed him by his real name. For burglary spotters and fans of the “$5 wrench attack”, it is a ready-made route map. Making money from the stolen WebAuth key requires soldering fake boards and setting up distribution. Making money from the leaked Shopify database takes nothing more than a crowbar and a train ticket.
5. The bottom line: the price of a “factory seal”
Let us put the whole construction together. Buyers are sold a “fully air-gapped” hardware wallet that generates its own seed phrase and signs transfers inside a sealed box. So that you are not afraid to entrust your savings to that box, the manufacturer offers to verify its authenticity on the website. In reality, the check rests on one shared secret for an entire warehouse batch, and the secret itself sits somewhere reachable through a leaky third-party tracker on the web server.
It gets better. For the precious box to reach your hands at all, you leave the store your surname, phone number and home address on the promise that the record will be erased in six months. The deletion script does not work for two years running, nobody notices, and the entire archive, together with the verification master key, drifts off to the attackers. And when the disaster comes to light, the very same outfit that slept through the breach and hoarded your addresses for two years steps up to the podium and asks you to take its word that the other keys are intact, wallets from before October 20 are safe, and a new, definitely reliable batch will arrive in a month.
Keystone is sending almost 19,000 of its devices under the industrial press simply because it can no longer tell its own products from counterfeits. Along the way, 38,837 people have earned permanent residence in criminal databases, complete with exact home addresses. A fine lesson for anyone who still believes that a pretty green checkmark on the manufacturer’s website and the words “Air-Gapped” on the box can replace real security.