Keystone Key Theft Threatens 18,835 Crypto Wallets

On Oct 27 2026 researchers reported an attacker accessed Keystone’s website and obtained the device verification key used by its hardware wallets to prove authenticity ¹. The company issued a statement on Oct 26 acknowledging the breach ¹. This key is what owners use online to verify their Keystone devices before they can sign transactions; a malicious actor with it could build counterfeit devices that pass those checks, possibly allowing them to steal crypto from unsuspecting buyers ¹.

The flaw stems from how Keystone’s firmware verifies device identity via Elliptic Curve Cryptography signatures. By compromising the private verification key, an attacker can forge valid signatures without needing physical access or specialized manufacturing equipment, letting fakes look indistinguishable from genuine units in both appearance and cryptographic behavior ¹.

Similar incidents have surfaced around Ledger devices five years ago when supply‑chain leaks exposed signing keys. While Ledger’s signature scheme differed, both cases underscore fundamental weaknesses if manufacturers do not secure internal tooling rigorously; once the secret key was compromised, any wallet previously verified through the manufacturer became vulnerable until further safeguards were deployed ¹.

Keystone estimates that up to 18,835 of its hardware wallets may be affected by the stolen key. Users who purchased Keystone devices after the incident should assume their tokens are at risk unless proven otherwise, and the company recommends verifying each device anew using independent methods and monitoring for unusual transaction patterns ¹.

This event highlights a broader trend where hardware security relies on proprietary secrets that, if leaked, can undermine entire ecosystems. It also illustrates why multi‑factor authentication and tamper‑resistant modules like YubiKeys remain superior, as they rely less on software‑managed certificates ¹.