Keystone to Destroy 18,835 Crypto Wallets After Hack

The hardware wallet manufacturer Keystone announced on October 26, 2026, the destruction of 18,835 unsold devices. This comes alongside the suspension of shipments following the hacking of its site on October 20. According to Keystone, the hacker obtained a key that would allow counterfeit devices to pass brand authenticity checks, as well as 25,964 buyer records.

In Brief

• 18,835 unsold crypto wallets will be destroyed and shipments are suspended (Keystone, October 26, 2026).
• The site was hacked on October 20 via a third-party data tracking tool: 25,964 buyer records from 2024 to 2026 are exposed.
• An authenticity key engraved during manufacturing, which cannot be modified, has been exposed: it could allow counterfeits to pass as authentic devices.

What Happened During the Keystone Hack?

A crypto hacker accessed Keystone's site on October 20, 2026, through a vulnerability in a third-party data tracking tool. The intrusion exposed 25,964 buyer records covering 2024 to 2026:

• names;
• contact details;
• shipping addresses;
• order information.

Keystone adds that 12,873 unpaid order records may have been affected. Adding both figures, there are up to 38,837 records involved in this crypto hack. The company firmly states that recovery phrases have not been exposed. The same goes for private keys and crypto wallet identifiers. However, this claim has not been confirmed by an independent source.

Why is Keystone Destroying 18,835 Unsold Crypto Wallets?

Keystone is destroying 18,835 unsold crypto wallets because the exposed authenticity key is integrated into each device during production. Therefore, it cannot be modified. An authenticity key is a secret identifier engraved in the device, which online checks verify to confirm its origin. With it, counterfeit devices could pass as authentic.

The 18,835 crypto wallets have not yet been sold. This allows Keystone to remove them before they reach customers. At this stage, Keystone does not specify whether counterfeit devices are already in circulation.

Regarding data retention, Keystone acknowledges a failure. An automatic deletion tool indeed malfunctioned without the company detecting it, leaving records beyond the 180-day deadline.

We did not meet our commitment to delete customer data on time, and we take responsibility for this failure. Keystone, hardware wallet manufacturer, post on X, October 26, 2026 (translated from French)

|---------------------------------------|-----------------------|---------------------------------------------------| | Element | Volume | Status According to Keystone | | Buyer Records (2024 to 2026) | 25,964 | Exposed: names, contact details, addresses, orders | | Unpaid Order Records | 12,873 | May have been affected | | Authenticity Key | 1 key, non-modifiable | Exposed | | Recovery Phrases, Private Keys | Not specified | Not exposed |

Source: Keystone, post on X, October 26, 2026; data retrieved on 27/10/2026.

What Does This Crypto Incident Change for a Buyer in France?

According to Keystone, crypto wallets delivered before October 20, 2026, remain safe if they pass authentication. Customers who received a device with the old key after this date must have it verified before use. Keystone adds that users also do not need to move their funds solely due to this intrusion.

The company also commits to replacing the authenticity key in new crypto wallets. And not just that! It will switch sales on the site to pre-order and reduce customer data retention to 90 days, down from 180 days (i.e., half).

Good to know: another manufacturer, Foundation, reported a separate breach the day before. The company recorded over 23,000 crypto phishing attempts from addresses that appeared official. It found no evidence of compromise of Passport devices or private keys. Old copies of databases had escaped its deletion at 60 days: approximately 5,600 postal addresses and 5,200 phone numbers are accessible, without Foundation being able to confirm how many were.

Both crypto hacks primarily affect sales data, with Keystone additionally facing an authenticity key issue. Furthermore, a planned deletion did not occur in either case. It remains to be seen whether counterfeit devices bearing the old key appear and whether Keystone details its investigation, with no date announced at this stage. For a buyer, the challenge in the coming weeks will be to verify the authenticity of a new crypto wallet with its manufacturer or an official reseller.