Supply chain

Keystone, which makes the Keystone 3 Pro bitcoin hardware wallet, detected unauthorized access to its website on October 20, 2026. Three days later, after reviewing Shopify API activity with Shopify, it confirmed that a third party had taken buyer records from its online store: names, contact details, shipping addresses, products bought and prices. Keystone says payment and bank details, government ID numbers, wallet passwords, recovery phrases and private keys were not involved, and that orders through Amazon and other channels were not affected.

On Monday, October 26, Keystone disclosed something worse. The attacker also took the WebAuth key, the secret behind the page owners use to check that a device is genuine. That key is written into each wallet at the factory and cannot be changed, so Keystone is destroying the 18,835 unsold devices that carry it, has paused shipping of unshipped web orders and has moved web sales to preorders until new stock with a fresh key is ready. Anyone who bought from Keystone's own store should expect targeted scams. Anyone running an online store should look hard at how the attacker got in, because third-party add-ons with data access run on many web shops.

How it works

Keystone says the attacker exploited a vulnerability in a third-party data monitoring tool used by its Shopify-based website and used it to escalate privileges. Keystone has not named the tool, said when the attacker first got in, or said who is responsible, and Decrypt notes those gaps. A monitoring add-on of this kind runs with its own API access to the store, so whoever takes it over inherits that access and can try to widen it. Keystone says the escalation reached both the customer records in Shopify and the WebAuth key.

The authenticity check works like this. On first boot, the wallet asks the owner to visit keyst.one/auth from another device. The page shows a QR code, the wallet scans it and displays a code, and the owner types that code back into the site. According to The Hacker News, the QR code carries the check code in encrypted form and the device decrypts it with its stored key, so a correct answer proves the device holds the key. Anyone else holding the same key can build hardware that gives the same correct answer.

That is the reason for scrapping stock. Keystone says the key plays no part in generating recovery phrases, deriving private keys or signing transactions, so existing wallets are no less secure. The risk is a counterfeit: a tampered device that passes the check, gets sold to someone, and later leaks or replaces the seed. Keystone says it has not confirmed any such device in circulation.

The record counts, and a deletion job that failed

Outlets report the customer data in ways that look contradictory. Decrypt and Blockhead give the full picture from Keystone's statement: 51,083 buyer records were in the Shopify store, 25,119 had already been erased, and the remaining 25,964, from purchases in 2024 to 2026, still held personal data. Cointelegraph leads with 51,083, most others with 25,964. Separately, 12,873 abandoned checkout records, from people who typed a name and address but never paid, may also have been reached; Keystone counts them as a precaution.

Most of those 25,964 records should not have existed. Keystone advertised that it deletes shipping data after 180 days, and on October 25 The Block reported customers saying their data was exposed anyway, one of them 214 days after their last order. In its October 26 statement, Keystone confirmed that the bulk erasure tool it built to get around Shopify's manual deletion process had failed on some tasks and the failures went undetected. On October 24 it asked Shopify to erase all overdue data; Shopify applies a 10-day wait, so that erasure is due today, November 3. Retention is being cut to 90 days, and Keystone says it has reported the breach to regulators in the EU, the UK and other jurisdictions.

Dates differ slightly too. Decrypt puts Keystone's first public notice on Saturday, October 24; Blockhead says October 25. Both agree the key theft was disclosed on October 26.

What Keystone owners should do

• A wallet delivered before October 20 that passes the keyst.one/auth check is genuine, Keystone says, and can be used normally.
• A wallet with the old key that arrived after October 20 might be a fake even if it passes. Keystone says it "cannot completely rule out the possibility that it is counterfeit". Do not load funds or a seed onto it until Keystone support has verified it.
• Keystone will never ask you to return a device. Treat any "recall" request, or any message about "asset migration", "wallet verification" or "investigation assistance" as a scam, whether it comes by email, text, phone call or letter. The letter matters: home addresses of crypto buyers were taken.
• Type keyst.one into the browser yourself rather than following links in messages.
• Never enter a recovery phrase into a website, an app or a device you did not order yourself.

What a company running a store should change

The way in was an add-on with access to the store's data, and Keystone has not said Shopify itself was at fault. For store owners, that turns into a concrete list:

1. Audit every installed app and its scopes. In the Shopify admin, open Settings, then Apps, choose an app, and use View details to see which personal data it can read. Remove anything nobody owns, and question any app that can read all customers and orders when its job does not need them. When you uninstall, check the theme for code the app left behind; Shopify warns that some apps leave it.
2. Keep secrets off the storefront. A device attestation key (the secret that lets your systems prove hardware is yours) has no reason to be reachable from the web store or anything an app token can touch. Keep it in a hardware security module or a separate signing service, and expose only a verify function, so the key itself never leaves.
3. Plan for the key you cannot rotate. If a secret is burned into hardware, decide in advance how you will issue a new one to new units, and how you will tell customers which units to trust.
4. Make the retention job report how many records it should have erased and how many it did, and alert when the two differ. Keystone's erasure failures went undetected until after the breach.
5. Keystone confirmed the theft from Shopify API activity, so that log is where to look. Alert on any app or token reading customer or order data in bulk or at an unusual hour.
6. Tell customers early what you will never ask them for, and which channels are really yours.

Our web penetration testing team tests what a store's apps and tokens can really reach, and attack surface management keeps a running list of the third-party code your site depends on. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Decrypt, Blockhead, Bankless, Cointelegraph, The Hacker News, The Block, Keystone statement on X, Casa: setting up Keystone, Shopify: app permissions, Shopify: uninstalling apps.