Keystone to destroy 18,835 wallets after a stolen WebAuth key, 25,964 buyer records exposed

Hardware-wallet maker Keystone said in a follow-up disclosure on October 26, 2026 that the data stolen in the October 20 Shopify breach includes a factory-burned WebAuth authentication key, and that the company will destroy 18,835 unshipped devices carrying the old key rather than ship them. Buyer records exposed total 25,964 fiches, with an additional 12,873 abandoned-checkout records containing contact details; the exposed set spans 2024 to 2026, per CoinDesk and corroborating detail from Journal du Coin.

The breach itself and the 180-day deletion gap were reported here on October 25. The destruction decision and the key compromise are new as of October 26–27.

What the WebAuth key does

The compromised key is burned into each device at manufacture and cannot be rewritten. Its sole function is to authenticate the device against Keystone's official website when a buyer runs a provenance check; it is not involved in signing transactions, deriving addresses, or securing seed phrases. Keystone's October 24 statement did not mention it; the October 26 update added it to the list of stolen data.

The supply-chain risk is specific:

• A forger holding the key could burn the same identifier into a counterfeit device, and that device would pass Keystone's website check.
• Keystone says it "cannot completely rule out" that a device shipped after October 20 with the old key is a counterfeit, and asks buyers of post-Oct. 20 orders to contact support before using the device.
• Devices shipped before October 20 that pass the authentication check remain trusted.
• Direct shipments from the Keystone site are paused; new sales switch to pre-order while devices with a new key are manufactured. Keystone has not disclosed when shipments resume.
• Devices sold through Amazon and other third-party channels are reported as not affected.

Keystone has not published whether the key is also used for firmware signature verification or for any supply-chain attestation beyond the website check.

Numbers and dates

• 18,835 devices to be destroyed — "partent à la casse" per Keystone's statement cited by Journal du Coin.
• 25,964 buyer records (names, contact details, shipping addresses, order details).
• 12,873 abandoned-checkout records also containing contact data.
• 180-day deletion policy → tightened to a new 90-day retention. The automated deletion tool failed silently, which is how pre-2025 records remained in the exported set.
• October 20, 2026: unauthorized access detected on the Shopify-powered storefront.
• October 23, 2026: breach confirmed after Shopify API-log review.
• October 24, 2026: first public disclosure (data exposure).
• October 26, 2026: second disclosure (WebAuth key, destruction decision).
• November 3, 2026: target completion date for Shopify erasure requests.

Keystone confirms private keys, recovery phrases, wallet passwords, payment-card and bank data were not accessed. No wallet balance is at risk from the breach itself.

What to watch

1. New-key device identifier. Keystone will need a way to let holders distinguish an old-key wallet from a new one; a firmware check or a batch-number cross-reference would be the clean fix. The company has not described it.
2. Counterfeit detections. If a counterfeit using the old key surfaces (via a lost-funds report), it establishes the threat model is real. Watch Keystone's incident channel and Reddit's r/CryptoCurrency hardware threads.
3. Firmware attestation. The destruction decision implies Keystone considers the key fundamental to device identity. A firmware update that rotates the website-side verification would reduce the destruction cost; its absence suggests the key is single-use-burn.
4. Independent audit of destruction. 18,835 wallets is a non-trivial amount of hardware; a third-party video or audit of the destruction would close the chain of custody.

Context

Keystone becomes the sixth hardware-wallet maker touched by a third-party-leak incident in 2026, in a sequence that includes Ledger's December 2020 Shopify incident (recurring in customer-impact stories), Coldcard, and others; Cointribune has grouped the sequence under a running tally. The destruction decision is the first time a maker has publicly committed to scrapping unsold inventory because of a key leak. The precedent — not the money — is what matters: hardware-wallet supply chains have no standard protocol for revoking a factory-burned identifier, and Keystone is improvising one in public.