Do not buy Keystone hardware wallet until new ones are produced

[PostQuantumBTC]

Indo not have confidence in hardware wallets again but for you that want to buy, you know what happened recently about the data hack, bit it goes more than that.

From Keystone investigation, it has been confirmed that the attackers also obtained the WebAuth key that Keystone is using to verify whether a device is genuine through their  device authentication page.

https://keyst.one/authentication/

This key is written into devices during manufacturing and can not be erased or rewritten. It is used exclusively to verify device authenticity during the WebAuth process. If the key is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks and be sold.


Keystone production will stop using the old key in response to that. All newly manufactured devices will use a new authentication key. 18,835 devices in existing inventory that contain the old key will be destroyed. They will not be sold or shipped to customers. Shipping of all unshipped orders from the official website has been suspended. Keystone sales will switch to a preorder model until production of devices using the new key is complete, after which shipping will resume.

For you that like to by from resellers, just know this and avoid buying Keystone for now.

https://x.com/KeystoneWallet/status/2114719318722404578

[5W-KILO]

The keystone Devs already decided to scrap all the thousands they made recently, the team already messed up and I hope that people will give me another chance, because they did the following right...

The way they package the keystone 3 is impressive, you can't move the hardware wallet out without tearing the pack, and also you can verify if the wallet is been tampered or not, especially it's firmware too.

You can't find this in other hardware wallet, or maybe those I know about, I like the decision they made and it is looking like they want to take full responsibility of their own mistakes.

[OcTradism]

Keystone production will stop using the old key in response to that. All newly manufactured devices will use a new authentication key. 18,835 devices in existing inventory that contain the old key will be destroyed.

For you that like to by from resellers, just know this and avoid buying Keystone for now.

Keystone must make a massive product recall and it's harmful for their reputation but how they can prevent a similar security incident to happen in the future will be vital for their business reputation, existence and development.

The current incident is already bad enough in damaging Keystone reputation and with me, it's hard for me to trust Keystone again. I have never been an user of Keystone hardware wallet and this incident makes me more hesitating to buy Keystone wallet if my intention is purchasing a hardware wallet.

It's not a specific bad thinking about Keystone hardware wallet but I feel the same with other hardware wallet manufacturers and resellers. How they can avoid tampering during a very long and complicated procedure from factory to reseller, then distribute to customers.

[m2017]

Indo not have confidence in hardware wallets again

Finally, something is shifting in people’s mindset. Anything involving assets (and their custody) cannot be a matter of trust (or faith); instead, it must be based on verification and evidence (reliability).

but for you that want to buy, you know what happened recently about the data hack, bit it goes more than that.

It’s unlikely that potential customers took the Keystone data leak as an advertisement urging them to buy one immediately.

From Keystone investigation, it has been confirmed that the attackers also obtained the WebAuth key that Keystone is using to verify whether a device is genuine through their  device authentication page.

Wonderful. Now all that’s left is for Keystone to leak its customer's seed-phrases directly.
 

This key is written into devices during manufacturing and can not be erased or rewritten. It is used exclusively to verify device authenticity during the WebAuth process. If the key is exposed, an attacker could use it to produce counterfeit devices that pass authentication checks and be sold.

Keystone owners who purchased their HW-devices before this incident shouldn't face any risks related to a key leak, right? They can just keep using their hardware wallets as usual?

Although, I suspect that anyone who owns a HW from a manufacturer that’s run into trouble this year is probably ready to burn their device to a crisp.

Keystone production will stop using the old key in response to that. All newly manufactured devices will use a new authentication key. 18,835 devices in existing inventory that contain the old key will be destroyed. They will not be sold or shipped to customers. Shipping of all unshipped orders from the official website has been suspended. Keystone sales will switch to a preorder model until production of devices using the new key is complete, after which shipping will resume.

Until a new WebAuth gets leaked again?

For you that like to by from resellers, just know this and avoid buying Keystone for now.

In my opinion, it’s best to refrain from buying any hardware wallets at all this year.

[Charles-Tim]

The keystone Devs already decided to scrap all the thousands they made recently, the team already messed up and I hope that people will give me another chance, because they did the following right...

I do not think Keystone will scrap it completely, all they need is to erase and replace the old keys with the new ones and call it new Keystone hardware wallet. So it will not be of a significant loss for them than their reputation and reputation of other hardware wallets that have significantly reduced. Many people that want to buy a hardware wallet before will be thinking otherwise now.

[hugeblack]

At the very least, they were brave enough to announce it, rather than ignoring or denying the matter.
Perhaps relying on an air-gapped wallet (using a flash drive) or a multi-signature setup involving multiple hardware wallets would be the best option.

[Hatchy]

I do not think Keystone will scrap it completely, all they need is to erase and replace the old keys with the new ones and call it new Keystone hardware wallet. So it will not be of a significant loss for them than their reputation and reputation of other hardware wallets that have significantly reduced. Many people that want to buy a hardware wallet before will be thinking otherwise now.

I actually thought about this when I read the news. They won't just scrap all the products, especially those that are still in their factory. All they need to do is replace the old key with the new one. Destroying so many products would be a huge loss and could keep them out of the market for a long time while they produce and ship new ones. The real problem is with those that have already been distributed to different resellers.

It's sad to see how hardware wallets have become a playground for hackers. They have managed to make people believe that nowhere is truly safe for storing their coins. On top of that, your personal data may not be safe when you buy hardware wallets from these companies because of data leaks. I hope these hardware wallet companies learn from these incidents and take the necessary steps to fix these flaws and improve their security.