Keystone Security Review After October 2026 Website Breach Exposing Buyer Records

Keystone security review focuses on the October 2026 breach of the company website that exposed buyer records while leaving on-device credentials secure. The incident, detected on October 20 and disclosed publicly on October 24, involved unauthorized access through a third-party monitoring tool. No recovery phrases, private keys, or transaction signing data were compromised.

Buyer records from 2024 through 2026 contained names, addresses, and order details for 25,964 customers. An additional 12,873 incomplete checkout records were also accessed. The attacker obtained a non-rewritable WebAuth key used solely for verifying device authenticity on the keyst.one site.

Details of the October 2026 Breach and Data Exposure

Attackers escalated privileges via a vulnerability in a third-party data tool integrated with the Shopify storefront. Keystone confirmed the scope through API logs by October 23 and notified users by email shortly after public disclosure. The company had retained some records past its stated 180-day policy because an automated deletion script failed without detection.

Payment information, government IDs, and bank details were never stored on the site and therefore remained outside the breach. Amazon and other sales channel data stayed unaffected. The compromised WebAuth key is separate from firmware signing keys and cannot be used to extract funds or seed phrases from delivered devices.

Users should follow these verification steps if they received a device on or after October 20:

• Contact support@keyst.one with the device serial number for authenticity confirmation.
• Run the still-functional authentication check on the official site before initialization.
• Ignore unsolicited messages claiming recalls, migrations, or verification assistance.

Impact on Device Authenticity and User Protections

Devices delivered before October 20 continue to function normally and pass existing authenticity checks. Units shipped later carry a theoretical risk of counterfeit substitution because the original WebAuth key is no longer trusted for new shipments. Keystone has committed to destroying 18,835 unsold devices containing the old key and will resume shipments only after new units with fresh keys are produced.

The company shortened its data retention policy to 90 days and requested deletion of qualifying Shopify records, with completion expected around November 3. Regulatory filings were submitted in the EU and UK. No fund losses or confirmed counterfeits linked to the incident have been reported as of November 5.

Current Status and Recommendations for Buyers

Keystone maintains open-source firmware, tamper-evident packaging on several models, and an active bug bounty program. The breach highlights common supply-chain risks across hardware wallet manufacturers rather than a failure of the air-gapped signing process itself.

Prospective buyers should place pre-orders only through official channels and allow the estimated four-to-six-week production window for new-key devices. Existing owners who have not received suspicious communications can continue normal use after completing the support verification step if their unit arrived after the breach date. Ongoing monitoring of the company’s official X account remains the most direct source for shipment resumption updates.