Keystone's Wallet Authentication Key Was Stolen, and 18,835 Wallets Will Be Destroyed
What began as a customer data leak at Keystone now reaches the devices themselves. The attacker also walked off with the key Keystone relies on to tell its wallets from fakes, and the company is destroying 18,835 units in stock. It comes as physical attacks on bitcoin holders run at record levels, so NodeWitness checked whether past leaks were followed by more attacks and compared how long five wallet makers hold on to buyers' addresses.
Update, October 27, 2026: Keystone released its incident report on Monday. We've added the theft of its authentication key, what to check if your device arrived after October 20, its warning about fake recalls and the number of exposed records. The analysis of Lopp's archive is unchanged; in the comparison table, only Keystone's retention period has been updated.
Keystone, a maker of hardware wallets for bitcoin and other cryptocurrencies, laid out on Monday how the intruder it detected on October 20 got into its official website. The attacker exploited a vulnerability in a third-party data monitoring tool used by the site to escalate privileges, which gave them some customer information and the WebAuth key the company uses to check whether a device is genuine [22][23]. Keystone's first notice, on October 24, mentioned only names, contact details, shipping addresses and order details, and said payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed [1]. It promised a detailed report "in the coming days" [2].
A stolen key that vouches for every device
Keystone has stopped using the old key in production and will destroy the 18,835 devices in its inventory that carry it. Shipping of all unshipped orders from its website is suspended, and sales have moved to preorders until devices with a new key are ready [22].
What to check if you own a Keystone
The cutoff is October 20, the day Keystone detected the intrusion. Devices delivered before then are unaffected and can be treated as genuine if they pass authentication [22]. For units received after that date with the old key, the company says that "even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit." Owners should contact support through its device authentication page for an additional check and hold off using the device until it is confirmed [22].
Keystone will not ask anyone to return a device. Anyone who asks you to ship yours back under the pretext of a "recall" should be treated as a scammer, the company warns, and the same goes for offers of "asset migration," "wallet verification" or "investigation assistance" [22]. A fake recall was exactly the lure in the emails Foundation customers received that same Monday, as covered at the end of this piece.
How many records leaked, and why they were still there
The Shopify store on Keystone's website generated 51,083 buyer records. Personal data in 25,119 of them had already been erased under the retention policy, but the remaining 25,964, spanning 2024 to 2026, still held names, contact details, shipping addresses and order information. Another 12,873 checkout records, from purchases never paid for, carried the shipping details people had typed in. Sales through Amazon and other channels were not affected [22].
Those records should have been gone after 180 days. Because Shopify's backend requires erasing records one at a time, Keystone built an automated bulk-erasure tool, which "did not operate reliably." Some erasure tasks failed and went unnoticed [22]. The company says it accepts responsibility, has asked Shopify to erase the overdue data and is cutting its retention period from 180 to 90 days [22].
A leak during a record run of physical attacks
Keystone's breach follows Ledger's January notice that the systems of its e-commerce partner Global-e had exposed customer names, addresses and orders [9], and Trezor's August report of a breach at its shipping provider ShipMonk [10]. For buyers, the worry is whether those lists end up on their doorstep. NodeWitness went through the 753 entries in the public physical attack archive maintained by Jameson Lopp [6] to see whether leaks come before more attacks, or merely alongside them.
Hours before Keystone's first post, an X user said a caller posing as police had asked whether he knew the brand, and that the caller's details matched an order he placed with Keystone in 2024 [3]. NodeWitness could not verify his account, though it fits what the company later admitted. Keystone had pledged to delete shipping information 180 days after an order [4], yet records from 2024 were still on file [22].
What Lopp's archive shows
The October 22 version of the archive lists 753 cases from December 2014 to October 6, 2026, the date of its latest entry [6]. Each entry is an incident, not a victim, and Lopp notes that the list is not comprehensive because many attacks go unreported [6]. 2025 ended with 167 cases, the highest in the series, up from 104 in 2024. This year already has 132, or 79% of last year's total, with nearly three months left to count.
The clearest shift is geographic. Europe, counting Russia, Ukraine and the UK, had 35 of 104 cases in 2024 (34%), 66 of 167 in 2025 (40%) and 71 of 132 so far in 2026 (54%). France alone has 81 cases since the start of 2024, more than the US (34) and Taiwan (32) combined. Spain appears 15 times, eight of them since 2024.
The archive does not tag attack types. A rough keyword search of the English descriptions by NodeWitness finds kidnappings or hostage-taking in 224 of the 753 entries (30%). In 66 (9%), attackers posed as couriers, police officers or someone else, rising to 10% since 2024 (41 of 403). That is the pattern closest to the risk of a leaked address, though the descriptions do not say how attackers found their victims.
Some of the growth reflects better coverage. The file went from 363 entries on September 30 to 701 on October 14, when hundreds of previously missing cases were added [6][7]. Europe's weight is not an artifact of that import. In the earlier version, European cases already made up 73% of 2026 (46 of 63), and France had 65 cases since 2024.
Leaks and attacks, month by month
To test whether leaks precede more attacks, NodeWitness counted cases in the six and twelve months before and after each major leak of wallet customer data. Fourteen entries with no month are excluded.
After Ledger's July 2020 breach notice, the archive goes from 16 cases in the prior six months to 22 in the following six. In December that year, Ledger's e-commerce database was dumped on a forum, with about 272,000 detailed records including names, postal addresses and phone numbers [8]. Around the dump, cases rise from 13 to 29 over six months and from 28 to 80 over twelve.
That jump coincides with the 2021 bull market and also shows up in the pre-import version of the archive, where cases go from 4 to 15 in the six months around the dump. A keyword search finds no entry that attributes an attack to a data leak; six mention Ledger, none in connection with the breach. Ledger itself said at the time that there was "no way to make any correlation between the data that has leaked and the funds on your wallet" [8].
Global-e shows no pattern. The archive has 84 cases in the six months before January 2026 and 84 in the six months after, although January itself, with 27, is the busiest month on record. It is too early to judge the ShipMonk breach, and Keystone's postdates the archive's latest case.
On this evidence, leaks cannot be shown to cause more attacks, nor ruled out. The archive relies on press reports, and it is rarely known how attackers picked their targets.
What each maker keeps
What buyers can weigh is how long their data stays around, and with whom. On October 25, 2026, NodeWitness reviewed the official privacy policies and support pages of five makers. "Not stated" means the pages consulted do not address the point.
| Maker | Shipping data | Longest retention | No-account checkout | Pickup away from home | Pay in bitcoin | Deletion on request |
|---|---|---|---|---|---|---|
| Ledger | Archived after three months [11] | Order data, 10 years [11] | Not stated | Not stated | BitPay, BTC or BCH, per a 2022 page [13] | Yes, answered within a month, unless law requires keeping it [12] |
| Trezor | Deleted after 90 days, including by its fulfillment partner [14] | Invoices, 10 years encrypted; crypto payments, 5 years at a third party [14] | Not stated | Packeta points and lockers in Czechia, Slovakia, Poland and Germany [15] | Yes, via a third party [14] | Yes, after delivery [14] |
| Keystone | 180 days by policy, but deletion failed; now 90 [4][22] | Repeat customers' orders, no clear limit [5] | Not stated | Not stated | Yes, via Coinbase Commerce and OpenNode [16] | Yes, after delivery [4] |
| COLDCARD (Coinkite) | Deleted after 120 days, per its blog; the policy sets no period [17][18] | Not stated | Yes; email login is for repeat buyers [19] | Not stated; suggests a PO box under an alias [18] | Yes, on-chain only, at a discount [19] | Yes, after delivery [18] |
| BitBox | Anonymized after 30 days; 180 at its shipping platform [20] | Invoices, 10 years encrypted [20] | Not stated | Not stated | Yes, via its own BTCPay Server [20] | Yes, answered within 30 days [20] |
Short retention windows limit what a breach can expose, but they depend on third parties. Trezor required its logistics partners to delete data after 90 days, yet in September it said ShipMonk had kept US orders from 2019 to 2021 despite confirming their deletion in writing. The breach affected 80,689 customers in all [10]. Buyers on Ledger's site purchase from Global-e, which processes their data as an independent controller under its own policy [11]. BitBox is the only one of the five that says it avoids cryptocurrency terms in the data it passes to carriers [20].
What buyers can do
Keystone maintains that no recovery phrases or private keys were exposed and that users do not need to move funds solely because of this incident [22]. The sensible response is to treat unexpected calls, letters and parcels with suspicion, and never to enter a recovery phrase into a device you did not order [1]. All five makers accept deletion requests, and filing one once the parcel arrives shortens the exposure window. For future orders, paying in bitcoin, using a dedicated email address and collecting from a pickup point leave less with third parties, as Trezor and Coinkite themselves suggest [10][18]. For those worried about coercion, Lopp recommends a multisig setup with keys stored in separate places [21].
As in the three hardware wallet attacks of 2026, the weak point was not the chip but everything around the device, much as DarkSword showed with seeds stored on iPhones. More coverage is collected under privacy and self-custody.
A customer list on its own does not reveal which bitcoin each buyer holds. That link depends on other tools, from block explorers to chain-analysis firms, and we look at what each one can learn about a wallet and where it falls short.
Keystone says it will email affected customers individually, launch a page where buyers can check whether their data was involved, and expects Shopify to finish erasing the overdue data on November 3 [22].
On October 26, two days after Keystone's first notice, Foundation, the maker of the Passport, confirmed that fraudulent emails had gone out from its official domains, some carrying the recipient's name and home address. We covered it in our piece on the fake Passport recall. The two cases share a failure. Foundation, too, was holding customer data it believed was gone, in copies of old orders left behind in legacy database tables that its redaction never touched [24].
Sources
Source type in parentheses. Web pages were accessed on October 25, 2026, except sources 22 to 24, accessed on October 27, 2026.
- Keystone (@KeystoneWallet), We owe you an apology, October 24, 2026, 17:59 UTC. Dates, exposed and unexposed data, response and expected scams. (Primary, official X account)
- Keystone (@KeystoneWallet), replies on X about the report ("upcoming week", "coming days"), October 24, 2026. Timing of the detailed report. (Primary, official X account)
- OG DEGEN (@PEPE_Whale69), post about a call from a fake police officer, October 23, 2026, 23:18 UTC, and a reply from another user. Unverified account of the call and the 2024 order. (Primary, user testimony)
- Keystone, Privacy Promises. Shipping data deleted 180 days after the order, and on request after delivery. (Primary, official website)
- Keystone, Privacy Policy, updated July 7, 2026. Shopify store; erasure for customers with no order in 180 days. (Primary, legal document)
- Jameson Lopp, Known Physical Bitcoin Attacks, attacks.json at the October 22 (commit c17c274, 753 entries), October 14 (9e8e81a, 701) and September 30, 2026 (51f2849, 363) versions. Counts and calculations by NodeWitness. (Primary, public database)
- Jameson Lopp (@lopp), post on the archive expansion, October 16, 2026. The total doubles to more than 700. (Primary, archive author)
- Pascal Gauthier, Message by Ledger's CEO, update on the July data breach, Ledger, December 21, 2020. Dump of the e-commerce database with about 272,000 detailed records. (Primary, official statement)
- Ledger, Global-e Incident to Order Data, January 2026. Customer data exposed in Global-e's systems. (Primary, official support)
- Trezor, Recent customer data exposed in shipping provider incident, August 13, 2026, updated September 4. ShipMonk breach, 80,689 affected and tips for ordering with less data. (Primary, official blog)
- Ledger, Privacy Notice, data collected during checkout. Ten-year retention, archiving after three months, purchases through Global-e. (Primary, legal document)
- Ledger, Privacy Policy, updated October 2026. Right to erasure unless law requires retention; reply within a month. (Primary, legal document)
- Ledger, What payment methods do you accept?, updated April 6, 2022. BTC or BCH via BitPay. (Primary, official support)
- Trezor, Privacy policy at Trezor. 90-day deletion, 10 years for invoices, 5 years for crypto payment records; deletion after delivery. (Primary, official support)
- Trezor, Trezor order pickup points and locker box delivery. Pickup points and lockers in four countries. (Primary, official support)
- Keystone, Sales Terms and Conditions. Crypto payments via Coinbase Commerce and OpenNode. (Primary, legal document)
- Coinkite, Privacy Policy, updated September 11, 2026. Retention "for so long as it is required," with no set period. (Primary, legal document)
- Coinkite, About Recent Physical Letters, June 24, 2026. Customer data deleted after 120 days, faster deletion after delivery, PO box under an alias. (Primary, official blog)
- Coinkite, store and customer login. Bitcoin discount, on-chain only; first-time buyers skip login. (Primary, official website)
- Shift Crypto, BitBox Privacy Policy, effective June 2026. 30-day anonymization, 180 days at the shipping platform, ten-year invoices, BTCPay Server and carriers. (Primary, legal document)
- Jameson Lopp, How to protect your bitcoin from $5 wrench attacks, Casa blog. Multisig with geographically separated keys. (Secondary, expert analysis)
- Keystone (@KeystoneWallet), Statement Regarding the Security Incident on Our Official Website and Customer Guidance, X article, October 26, 2026. Entry point, stolen WebAuth key, 18,835 units to be destroyed, paused shipping, 25,964 buyer records and 12,873 unpaid checkouts, failed erasure tool, guidance by delivery date and fake recall warning. (Primary, official X account)
- Felix Ng, Keystone breach deepens: Hackers stole key used to verify wallets as genuine, Cointelegraph, October 27, 2026. Summary of Monday's statement. (Secondary, press)
- Foundation, Incident Update and Incident Update 2, official forum, October 26, 2026. Copies of old orders left in legacy tables after database migrations. (Primary, official forum)
More in Privacy and self-custody
Last updated: October 27, 2026