KEYSTONE’S DEVICE AUTHENTICATION KEY STOLEN — 18,835 WALLETS IN STOCK TO BE DESTROYED — AFTER OCTOBER 20, A PASSED CHECK NO LONGER PROVES A DEVICE IS GENUINE

On October 26, 2026, at 14:02 UTC, Keystone posted the report it promised on the breach it found October 20. The attacker got in through “a third-party data monitoring tool” on its website. Keystone says that “enabled the attacker to obtain some customer information and a key used to verify the authenticity of our devices.” That key “is written into devices during manufacturing and cannot be erased or rewritten.” With it, Keystone says, “an attacker could use it to produce counterfeit devices that pass authentication checks.”

So Keystone will destroy the 18,835 devices in its stock that carry the old key, has stopped shipping website orders, and is moving to preorders until new-key devices are built. The count its October 24 post lacked is here too: 25,964 buyer records from 2024 to 2026 still held names, contact details and shipping addresses, plus 12,873 unpaid checkouts. They were meant to be gone. Keystone’s policy was to erase buyer records after 180 days, but its bulk erasure tool “did not operate reliably.” Its words: “We failed to fulfill our commitment to erase customer data on time.” Foundation said much the same about its own purge promise on October 26.

Now the part that matters if you own one. Keystone’s own check at keyst.one/authentication proves less than it did. For a device received after October 20 with the old key, Keystone writes: “Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit.” For a device delivered before that date, it says a pass means genuine. The line sits at October 20, which Keystone calls “the date we discovered the unauthorized access.” The statement does not say when the attacker first got in, or when the key was taken.

A check you could run yourself was the point of the check. For an old-key Keystone, the proof is now a delivery date and an email to support. Keystone says the key is “not involved in recovery phrase generation, private key derivation, or transaction signing,” and that seeds and keys were not touched. But a fake device does not need your seed. It makes one for you, and Keystone itself says fakes could mean “asset theft.” If yours came after October 20, do not fund it until support confirms it. And Keystone says it “will not ask you to return your device.” Anyone who does is not Keystone. At the time of this writing, bitcoin was $79,999.