Keystone Halts Web Orders, Will Junk 18,835 Wallets in Stock Over Stolen Authenticity Key

The wallet maker also said 25,964 buyer records exposed in the breach still held names and addresses, some beyond its 180-day retention limit. Hardware wallet maker Keystone said in an October 26 post on X that it will destroy 18,835 devices sitting in its inventory after the intruder behind its website breach also obtained the WebAuth key that underpins its device-authenticity checks. The danger lies in how the key works. Keystone burns it into its devices during manufacturing and cannot erase or rewrite it later.