Keystone wallet data breach

[Pmalek]

There's no way for me to tell what I'm about to point to is true or not... However, there's a user who claims he/she ordered 214 days before the data breach and still received an email from Keystone that says he/she is affected ^[source] and there's another user who claims to be a former employee of Keystone and it says the 180-day claim is false ^[source].

I am not surprised. Companies saying and promising one thing but doing something completely different has become normal. In their statement about this incident, they said that they created an automated tool for deleting customer data, but it didn't work properly. It deleted some data and left other. They also said that they didn't detect that the tool wasn't working efficiently, so they didn't know it needed to be fixed. I call bullshit. They surely knew but didn't care. Now they promise that they will do better in the future. We have seen it so many times already.

[rdluffy]

As a result, the company states that new devices will begin using a new authentication key and that 18,835 wallets currently in stock will be destroyed.

18,835 wallets 

I never really realized just how big the hardwallet market is
There are a lot of devices being manufactured and sitting in stock

Another one to add to the list of data breaches and exploits 

[dkbit98]

This situation with breaches and exploits are seriously getting out of hand, and I think worse is yet to come.
If they can breach so many hardware wallet websites than they can certainly breach other financial institutions and banks.
It is better for everyone to get prepared for even more crazy news in next 2027 that is coming in few months.

[tabas]

As a result, the company states that new devices will begin using a new authentication key and that 18,835 wallets currently in stock will be destroyed.

18,835 wallets 

I never really realized just how big the hardwallet market is
There are a lot of devices being manufactured and sitting in stock

Another one to add to the list of data breaches and exploits 

It certainly is a big market and that's why hackers would simply go after their database from the purchase and from tampering their chips, it's easier to go rather than each individual. Those who have been against crypto now have a narrative to tell others to stay away not only from using hardware wallets but also in investing.

When you run a hardware wallet company and see competitor getting breached or even going as far as getting tampered yet there's no meaningful backlash nor meaningful legal escalation, the best thing you could do to save your business is to issue apology and forget it .

That's the best that they can do instead of making solutions and assurance that victims will be more secured and some compensation. I hope victims will step up and sue them.

[Wind_FURY]

As a result, the company states that new devices will begin using a new authentication key and that 18,835 wallets currently in stock will be destroyed.

18,835 wallets 

I never really realized just how big the hardwallet market is
There are a lot of devices being manufactured and sitting in stock

Another one to add to the list of data breaches and exploits 

This is no "mere" private information leak. This is more dangerous because with the the stolen authentication keys, those nefarious actors could "confirm" your device is "secure" even if it's NOT.

Keystone said attackers obtained its WebAuth key, which is embedded into hardware wallets during manufacturing and used to verify device authenticity.

Unlike a wallet’s private keys, the WebAuth key does not control cryptocurrency funds or authorize transactions.

However, its exposure potentially allows attackers to manufacture counterfeit devices capable of passing Keystone’s official authentication process.

https://solidintel.news/keystone-wallet-breach-authentication-key-customer-data/

DON'T BUY A HARDWARE WALLET FROM KEYSTONE.

[greysonz]

Mark Karpeles poses an interesting question, and the key point is this: during Keystone production, as part of the factory self-test during initial boot, the device generates and stores a private key itself, and also records the public key.

And based on this: if thieves have private keys that can be stolen, does that mean *somehow* a copy of the key exists outside the secure element on the device? It should be in a single private copy.

And obviously, if there are copies of keys outside the device, why is there such a disregard for privacy and security? The device should generate the key and include its own public key in the self-test report, not the other way around.

[Pmalek]

This is no "mere" private information leak. This is more dangerous because with the the stolen authentication keys, those nefarious actors could "confirm" your device is "secure" even if it's NOT.

Keystone said attackers obtained its WebAuth key, which is embedded into hardware wallets during manufacturing and used to verify device authenticity.

Unlike a wallet’s private keys, the WebAuth key does not control cryptocurrency funds or authorize transactions.

However, its exposure potentially allows attackers to manufacture counterfeit devices capable of passing Keystone’s official authentication process.

https://solidintel.news/keystone-wallet-breach-authentication-key-customer-data/

DON'T BUY A HARDWARE WALLET FROM KEYSTONE.

Someone correct me if I am wrong, but this is how I understood this. WebAuth keys aren't unique for each device. An entire batch of hardware wallets have the same WebAuth key. Keystone talks about old and new keys. They will get rid of the old WebAuth key. Genuine and non-manipulated Keystone units aren't at any risk security-wise, regardless when they were sold. Even if it's a unit with the leaked WebAuth key. The problem is that even if a Keystone (with the leaked WebAuth key) passes the authenticity check, you can't be sure that it's genuine just because it passed the check. You would have to get in touch with their customer support team and perform additional checks.

Just like with the Ledger implants, the biggest threat model now is supply chain attacks. Someone filling store shelves and reseller stock with modified devices that can pass the authenticity checks.

[SFR10]

n their statement about this incident, they said that they created an automated tool for deleting customer data, but it didn't work properly. It deleted some data and left other. They also said that they didn't detect that the tool wasn't working efficiently, so they didn't know it needed to be fixed. I call bullshit. They surely knew but didn't care.

I agree... Relying solely on an automated tool without periodic inspections for such sensitive data clearly shows how much they really care about their customers ^[SMH]!

• The problem is that even if a Keystone (with the leaked WebAuth key) passes the authenticity check, you can't be sure that it's genuine just because it passed the check. You would have to get in touch with their customer support team and perform additional checks.
  

  Unfortunately, that's right, and I'm interested in learning more about the additional verification procedures needed to confirm these devices' authenticity.
  ^{- Since they haven't disclosed the steps, I think they're still trying to figure out the right way (I hope I'm wrong).}
  

[nikola22]

Genuine and non-manipulated Keystone units aren't at any risk security-wise, regardless when they were sold. Even if it's a unit with the leaked WebAuth key.

one clarification: Keystone units aren't at any risk if they were purchased before October 20, 2026 (according to the company). if the device was purchased after October 20, there’s a chance it might be a counterfeit. on the Keystone device verification website this message appears if you wish to verify the device:

[Myleschetty]

Genuine and non-manipulated Keystone units aren't at any risk security-wise, regardless when they were sold. Even if it's a unit with the leaked WebAuth key.

one clarification: Keystone units aren't at any risk if they were purchased before October 20, 2026 (according to the company). if the device was purchased after October 20, there’s a chance it might be a counterfeit. on the Keystone device verification website this message appears if you wish to verify the device:

That's good to know, but according to what they said here
"Our investigation found that the incident involved 51,083 buyer records generated by purchases made through the Shopify store on our official website. These records were stored and managed by Shopify. Customer purchase information from Amazon and other sales channels was not affected."

I'm astonished that a company specializing in crypto hardware wallets is relying on Shopify as one of the platforms to use for selling its products, given that crypto enthusiasts private information is now highly valuable to malicious actors.

https://x.com/KeystoneWallet/status/2114719318722404578

[greysonz]

Keystone users have been receiving a flood of text messages from scammers:

Oh good, they have my phone number too.

https://x.com/infinitybanyan/status/2115114416983384270?a=dzy36eStN-7PBJvPkfA&s=19

[Pmalek]

Unfortunately, that's right, and I'm interested in learning more about the additional verification procedures needed to confirm these devices' authenticity.
^{- Since they haven't disclosed the steps, I think they're still trying to figure out the right way (I hope I'm wrong).}

Not necessarily. Maybe they don't want to make the additional security checks public so as to not give bad actors new ideas of how to abuse it and improve their manipulation techniques.

one clarification: Keystone units aren't at any risk if they were purchased before October 20, 2026 (according to the company). if the device was purchased after October 20, there’s a chance it might be a counterfeit.

That's assuming everything they are saying is true and that only that production batch with that one WebAuth key got leaked. If older WebAuth keys got leaked earlier or at the same time as the last one and they are not aware of it (yet) and only discovered the October 20 leak, then units sold earlier could be risky as well.

[Wind_FURY]

This is no "mere" private information leak. This is more dangerous because with the the stolen authentication keys, those nefarious actors could "confirm" your device is "secure" even if it's NOT.

Keystone said attackers obtained its WebAuth key, which is embedded into hardware wallets during manufacturing and used to verify device authenticity.

Unlike a wallet’s private keys, the WebAuth key does not control cryptocurrency funds or authorize transactions.

However, its exposure potentially allows attackers to manufacture counterfeit devices capable of passing Keystone’s official authentication process.

https://solidintel.news/keystone-wallet-breach-authentication-key-customer-data/

DON'T BUY A HARDWARE WALLET FROM KEYSTONE.

Someone correct me if I am wrong, but this is how I understood this. WebAuth keys aren't unique for each device. An entire batch of hardware wallets have the same WebAuth key. Keystone talks about old and new keys. They will get rid of the old WebAuth key. Genuine and non-manipulated Keystone units aren't at any risk security-wise, regardless when they were sold. Even if it's a unit with the leaked WebAuth key. The problem is that even if a Keystone (with the leaked WebAuth key) passes the authenticity check, you can't be sure that it's genuine just because it passed the check. You would have to get in touch with their customer support team and perform additional checks.

Just like with the Ledger implants, the biggest threat model now is supply chain attacks. Someone filling store shelves and reseller stock with modified devices that can pass the authenticity checks.

Supply chain attacks have ALWAYS been the biggest threat to hardware wallet users, but no entity has done the attack at scale YET. The best attempt was the Chinese company that bought CryptoBilis from the Malaysian owner, then letting the Malaysian owner sign a Non-Disclosure Agreement not to say that CryptoBilis was indeed sold.

Trezor users who bought their device from that store should probably weigh them in a pawn shop where the scales are very accurate.