Keystone has stopped selling its Bitcoin hardware wallets after attackers got hold of the factory key the company uses to prove a device is genuine. With that key, someone can build counterfeit units that still pass Keystone's own verification. The company says 25,964 buyer records were caught up in the incident, and that recovery phrases and private keys were not involved.
What the factory key actually does
Hardware wallets ship with a way for the device to show it came from the manufacturer and hasn't been swapped or tampered with in transit. Keystone's version of that check relies on a key held on the factory side. If an outsider has it, the check stops being proof of anything. A cloned wallet could present itself to a buyer as legitimate and still be running someone else's code underneath.
That's the part that matters for anyone holding a Keystone. The threat isn't that existing seeds were lifted — Keystone says they weren't. It's that the supply chain's authenticity signal is now untrustworthy, which is why the company pulled the products rather than keep shipping.
Nearly 26,000 buyer records
The breach also touched 25,964 records tied to buyers. Keystone hasn't said publicly what fields those records contained, and it hasn't described how the key was taken or when the company first noticed. Those are the two questions customers are most likely to ask first: what's in the data, and how long was it exposed before the sale was halted.
For a hardware wallet maker, buyer records are unusually sensitive. They tie a person to a purchase, and in the crypto context that's often enough to make someone a target. The company's statement so far is limited to the scope of the technical damage: no phrases, no private keys.
The verification gap users now face
Keystone's own check can no longer be assumed to separate real devices from fakes. Anyone holding a Keystone purchased before the halt has no straightforward way to confirm, using the company's tooling alone, that their unit came off a legitimate line. Keystone hasn't yet published replacement verification steps or said whether it will reissue devices to affected buyers.
The pull from sale is the immediate, blunt response. It also leaves the company with a shrinking product line while it works out how to restore trust in a check that depends on a secret it can no longer keep. Competing wallet makers that rely on similar factory-side provisioning will be watching whether Keystone publishes a full post-mortem or stays with the terse statement it's given so far.
What's outstanding: Keystone hasn't set a date for resuming sales, hasn't detailed the record contents, and hasn't explained the key's exposure window. Until it does, the practical advice for existing owners is the same one that applies whenever an authenticity check breaks — treat the device's provenance as unverified and move holdings to a wallet you can account for from scratch.
