Keystone will destroy 18,835 wallets after a device-authentication key was stolen, the hardware wallet maker said. The affected wallets are linked to a security breach that compromised the authentication mechanism used to verify devices. Starting October 20, owners of old-key devices received after that date will face additional authenticity checks — even if their wallet already passes Keystone's online verification.
What the key theft means for wallet owners
The stolen key is part of Keystone's device-authentication system, which is supposed to confirm that a wallet is genuine and hasn't been tampered with. With that key in someone else's hands, the normal verification process can no longer be trusted on its own. That's why the company is taking the drastic step of destroying nearly 19,000 wallets rather than letting them circulate with a compromised security layer.
Keystone hasn't said how the key was stolen or who might be behind it. The company also hasn't disclosed whether any user funds were lost. What it has confirmed is the scale: 18,835 wallets will be permanently disabled.
Why some devices need extra checks
The additional authenticity checks apply to old-key devices that were received after October 20. That cutoff date matters because it separates devices that may have been manufactured or shipped before the key theft from those that could have been exposed afterward. Even if one of these wallets passes Keystone's standard online verification, the company says the extra checks are still required. In practice, that means owners can't rely on the usual green checkmark — they'll need to go through a more rigorous process to confirm their device is legitimate.
Keystone hasn't detailed what those checks involve or how long they'll take. But the message is clear: for a certain batch of devices, the old verification isn't enough.
The destruction process and what owners should do
Destroying 18,835 wallets is a logistical undertaking. Keystone will likely need to coordinate with retailers and users to ensure the affected devices are taken out of circulation. The company hasn't outlined how it will verify that destruction has happened or whether owners will receive replacements.
For now, owners of Keystone wallets should check whether their device falls into the affected group. If it was received after October 20 and uses an old authentication key, they should expect to undergo the additional checks. Keystone is expected to provide more details on the process in the coming weeks.
What's still unknown
Several key questions remain unanswered. Keystone hasn't said how the key was stolen, whether the thief has been identified, or if there's any risk to wallets that aren't in the 18,835 group. The company also hasn't commented on whether the destruction will be voluntary or mandatory for affected owners.
The wallet maker is likely to face scrutiny over its security practices. Device-authentication keys are a critical line of defense for hardware wallets, and their compromise raises concerns about the supply chain and manufacturing process. Keystone will need to explain how it plans to prevent similar thefts in the future.
For now, the focus is on the immediate deadline: October 20. Owners of old-key devices received after that date should prepare for additional authenticity checks, even if their wallet passes the online test. Keystone is expected to release more information soon, and users should watch for official communications about the destruction process and replacement options.
