---
title: Keystone Pulls Hardware Wallets After Theft of Authenticity Key
url: >-
  https://www.cryptocatalyst.news/articles/2026-10-28-keystone-pulls-hardware-wallets-after-theft-of-authenticity-key
canonical: >-
  https://www.cryptocatalyst.news/articles/2026-10-28-keystone-pulls-hardware-wallets-after-theft-of-authenticity-key
date: '2026-10-28T13:08:31.762802+00:00'
category: web3
tags:
  - keystone
  - hardware-wallet
  - security
  - data-breach
source: Decrypt
source_url: 'https://decrypt.co/381983/bitcoin-wallet-keystone-devices-destroyed-stolen-key'
publisher: CryptoCatalyst
summary: >-
  Keystone says hackers stole a factory key that could help counterfeit wallets
  pass authenticity checks. The incident affected 25,964 buyer records.
image: >-
  https://www.cryptocatalyst.news/images/articles/2026-10-28-keystone-pulls-hardware-wallets-after-theft-of-authenticity-key.webp
generated_by: automated editorial pipeline
---
# Keystone Pulls Hardware Wallets After Theft of Authenticity Key

Keystone is pulling affected hardware wallets after attackers stole a factory key used to verify that its devices are genuine. The company says 25,964 buyer records were affected, but recovery phrases and private keys were not involved.

## Key takeaways

- Attackers obtained Keystone’s factory key used to verify whether its hardware wallets are genuine.
- Keystone says 25,964 buyer records were affected.
- Keystone says recovery phrases and private keys were not involved.
- The company is pulling affected devices because counterfeit wallets could pass authenticity checks.

Keystone is pulling affected hardware wallets after attackers obtained a factory key used to verify that its devices are genuine. The stolen key could help counterfeit devices pass Keystone’s authenticity checks, creating a risk that goes beyond the theft of customer information.

Keystone says 25,964 buyer records were affected. It also says recovery phrases and private keys were not involved in the incident, so the disclosure does not indicate that customers’ wallet funds were directly exposed.

## What does the stolen Keystone key put at risk?

The key is used to establish that a wallet came from Keystone. If someone can use it to make a fake device appear genuine, buyers may have a harder time distinguishing a counterfeit from an authentic wallet. That is a device-trust problem, not the same thing as an attacker gaining access to a user’s recovery phrase or private key.

The distinction matters: a hardware wallet protects crypto by keeping sensitive signing information away from internet-connected devices, but customers also need confidence that the hardware they set up is authentic. Keystone says the key theft did not involve wallet secrets; the reported concern is that fakes may evade its verification process.

## What should Keystone buyers do?

Keystone is pulling devices, but the report does not specify which models or how customers should arrange a return or replacement. Buyers should follow the company’s official instructions and avoid treating a device as verified solely because it passes an authenticity check that may rely on the stolen key.

This is a different risk from the [hidden LTE implant reported in a recent case involving CryptoBilis-sold wallets](/articles/2026-10-13-ledger-finds-lte-chip-in-cryptobilis-devices-that-captured-wallet-recovery-phras): that device was described as capturing recovery phrases during setup, while Keystone says its customers’ recovery phrases and private keys were not involved. For Keystone users, the key practical question is therefore whether their device is affected and what verification method the company recommends next.

## FAQ

### Were Keystone wallet recovery phrases stolen?

Keystone says recovery phrases and private keys were not involved in the incident. The reported theft concerned a factory key used to verify device authenticity.

### Why is Keystone pulling hardware wallets?

Attackers obtained a factory key that could help counterfeit wallets pass Keystone’s authenticity checks. The company is pulling affected devices to address that risk.

### How many Keystone buyer records were affected?

Keystone said 25,964 buyer records were affected.

## Source

This article is a summary of reporting by [Decrypt](https://decrypt.co/381983/bitcoin-wallet-keystone-devices-destroyed-stolen-key), written by an automated editorial pipeline. See https://www.cryptocatalyst.news/editorial-policy.

## How to cite

CryptoCatalyst.news, "Keystone Pulls Hardware Wallets After Theft of Authenticity Key", 2026-10-28, https://www.cryptocatalyst.news/articles/2026-10-28-keystone-pulls-hardware-wallets-after-theft-of-authenticity-key