Keystone is scrapping nearly 19,000 of its own devices after a security breach exposed 25,964 buyer records. The hardware wallet maker said some of those records sat on its systems well past the 180-day deletion deadline it promises customers, because an automated cleanup tool stopped working and nobody caught it.
The company is destroying the affected units rather than reselling or recycling them. That's a costly call for a firm that sells physical devices, but it's the one Keystone says the breach demands.
What actually leaked
The exposed data covers 25,964 people who bought from Keystone. The company hasn't said in its disclosure exactly which fields were in those records, but the scale — roughly the population of a mid-sized town — is the headline number here.
The more damaging detail is the timing. Keystone's own policy says buyer records get wiped 180 days after purchase. An automated tool was supposed to handle that. It didn't. The tool failed silently, and the failure went unnoticed until the breach surfaced.
That gap matters because it means customer data lived on Keystone's servers longer than the company told buyers it would. A deletion policy is only as good as the system enforcing it, and this one wasn't enforcing anything.
Why the wallets are being destroyed
Scrapping 19,000 devices is an unusual response. Most firms hit by a data breach patch the hole, notify customers, and move on. Keystone is taking the physical inventory out of circulation entirely.
The company hasn't spelled out the exact link between the leaked records and the hardware being destroyed — whether the devices themselves are compromised or whether Keystone simply doesn't want units tied to exposed buyers reaching the secondhand market. Either way, the decision signals the firm is treating this as more than a database cleanup.
For buyers, the practical question is what happens to wallets already in their hands. Keystone's disclosure doesn't address whether existing users need to migrate funds or replace devices. That's the detail holders will be watching for.
The silent failure problem
Automated deletion jobs fail all the time. Cron tasks break, credentials expire, a dependency gets deprecated and the job quietly stops running. What's supposed to catch that is monitoring — an alert, a dashboard, someone checking that the thing that's supposed to run actually ran.
Keystone didn't have that catch in place, by its own account. The tool failed, and the company found out only after the breach. That's a process failure sitting underneath the security failure, and it's the kind of thing regulators and auditors tend to ask about later.
The 180-day promise is also worth noting on its own. Data-retention limits are a legal requirement in several jurisdictions and a marketing promise everywhere else. Missing your own deadline by an unknown margin is a bad look regardless of what leaked.
What Keystone hasn't said
The disclosure leaves several things open. There's no timeline for when the deletion tool broke or how long records lingered past the 180-day mark. There's no word on whether the affected buyers have been contacted individually or how the 19,000 destroyed devices map to the 25,964 exposed records.
Keystone also hasn't said whether it reported the incident to any data protection authority. Depending on where its customers live, that may not be optional.
The next concrete step is the device destruction itself, which the company says is coming. Buyers who want clarity on whether their own wallet is affected should expect Keystone to publish more detail before that happens — and if it doesn't, that silence will be its own story.
