Keystone Hardware Wallet Breach: 18,835 Devices Being Destroyed
Written with artificial intelligence.
Keystone has announced the destruction of 18,835 old hardware wallets after a breach allowed an attacker to obtain its device authentication key. The company warns that units received after October 20th may be counterfeit, even if they pass authenticity checks.
Overview of the Keystone Breach
Keystone, a hardware wallet manufacturer, is facing significant repercussions from a recent security breach. On October 20th, the company detected unauthorized access that led to the compromise of its device authentication key, which is critical for verifying the authenticity of its wallets. As a response, Keystone has decided to destroy 18,835 wallets in its inventory that contain this compromised key.
Implications of the Breach
The WebAuth key is embedded in each device during manufacturing and is crucial for confirming whether wallets are genuine. While it does not affect transaction signing or seed generation, if this key falls into the wrong hands, it could enable counterfeit devices to pass Keystone's authenticity checks. To mitigate this risk, new units will be issued with a fresh key, and current orders will be halted in favor of preorders until the new stock is available.
Customer Data Exposure
The breach also compromised buyer information, with 25,964 records exposed, including names, contact details, and order information. Keystone is additionally monitoring 12,873 unpaid checkout records. However, sensitive information such as seeds, private keys, bank details, and government IDs remain secure. The company has acknowledged a failure in its automated data erasure process that allowed older shipping data to be accessed, prompting a reduction in data retention from 180 days to 90 days.
Guidance for Wallet Owners
For customers who received a device before October 20th, Keystone assures that any device passing authentication checks is genuine. However, those who received devices after this date should be cautious, as the company cannot fully guarantee their authenticity. Keystone advises contacting support for verification before using any suspicious devices. It's also important to note that Keystone will not request any device returns, and any such requests should be treated as scams.
Broader Context
Keystone is not alone in facing security challenges this year. Other hardware wallet manufacturers, such as Trezor and Ledger, have also experienced significant breaches, indicating a broader trend of attacks targeting the surrounding ecosystem rather than the secure chips themselves. Users are advised to purchase directly from manufacturers and only enter recovery seeds into devices they ordered themselves.