Keystone to destroy 18,835 crypto wallets after hack

The manufacturer of hardware crypto wallets Keystone announced on October 26, 2026 the destruction of 18,835 unsold devices. Added to this is the suspension of shipments after the hacking of its site on October 20. According to Keystone, the crypto hacker obtained a key that would allow counterfeit devices to pass the brand’s authenticity checks as well as 25,964 buyer records.

What happened during the Keystone hack?

A crypto hacker accessed the Keystone site on October 20, 2026 through a breach in a third-party data tracking tool. The intrusion has exposed 25,964 buyer files covering 2024 to 2026 :

• names ;
• contact details ;
• delivery addresses;
• order information.

Keystone adds that 12,873 unpaid order records may have been affected. By adding the two figures, we therefore count up to 38,837 records concerned by this crypto hack. The company strongly maintains that the recovery phrases were not exposed. The same goes for private keys and crypto wallet identifiers. However, this claim has not been confirmed by an independent source.

Why is Keystone destroying 18,835 unsold crypto wallets?

Keystone destroys 18,835 unsold crypto wallets because exposed authenticity key is built into each device during production. It cannot therefore be modified. An authenticity key is a secret identifier burned into the device, which online checks verify to confirm its origin. With it, counterfeit devices could pass as authentic.

THE 18,835 crypto wallets have not yet been sold. This allows Keystone to remove them before they arrive at customers. At this stage, Keystone does not specify whether counterfeit devices are already circulating.

However, when it comes to data retention, Keystone recognizes a failure. An automatic deletion tool actually broke down without the company detecting it, thus leaving records beyond the 180-day deadline.

We failed to keep our commitment to delete customer data on time, and we take responsibility for this failure.

Keystone, maker of hardware wallets, published on X, October 26, 2026 (translated from English)

What does this crypto incident change for a buyer in France?

According to Keystone, crypto wallets delivered before October 20, 2026 remain secure if they pass authentication. Customers who received a device with the old key after this date must, however, have it checked before using it. Keystone adds that users also do not have to move their funds simply because of this intrusion.

The company is also committed to replace the authenticity key in new crypto wallets. And not only that! It will switch the site’s sales to pre-orders and reduce the retention of customer data to 90 days, compared to 180 today (i.e. half as much).

Good to know: another manufacturer, Foundation, has reported the day before a distinct attack. The company identified over 23,000 crypto phishing attempts from addresses that seemed official. She found no evidence of compromise of Passport devices or private keys. Old database copies had escaped deletion after 60 days: approximately 5,600 postal addresses and 5,200 telephone numbers are accessible, without Foundation being able to confirm how many have been.

The two crypto hacks therefore first affect sales data, to which Keystone adds an authenticity key. Furthermore, a planned deletion did not take place in both cases. It remains to be seen whether counterfeit devices bearing the old key appear and whether Keystone details its investigation, with no date announced at this stage. For a buyer in any case, the challenge in the coming weeks will be to check the authenticity of a new crypto wallet from its manufacturer or an official reseller.