Keystone breach widens as attacker obtains device authentication key
- —The attacker exploited a flaw in a third-party monitoring tool on Keystone's Shopify site
- —25,964 buyer records from 2024–2026 and 12,873 unpaid checkout records were exposed
- —The factory-written key cannot be changed but plays no role in seed creation or signing
- —Keystone is cutting shipping-data retention from 180 to 90 days
Why it matters: The breach undermines hardware wallet authenticity checks, so buyers should order direct and verify any device received after Oct. 20.
Source: Bankless