An intruder who breached Keystone's website on October 20, 2026, obtained a WebAuth key used during manufacturing to verify device authenticity, which cannot be erased or rewritten once burned into hardware

Overview Debates Related claims Topics Sources

Cc9f267dcClaimNews event

Keystone reduced its customer data retention policy from 180 days to 90 days following the October 20, 2026 breach

Keystone stated that hardware wallets manufactured and delivered before October 20, 2026, remain safe and that their private keys and recovery phrases were not compromised

Keystone announced on October 26, 2026, that it will destroy 18,835 unsold hardware wallet devices in its inventory carrying the compromised WebAuth key stolen in the October 20, 2026 breach

Keystone stated that the WebAuth key stolen in the October 20, 2026 breach allows attackers to manufacture counterfeit hardware wallets that pass official authenticity checks, creating a risk of asset theft for buyers

On October 26, 2026, Bitcoin hardware wallet manufacturer Keystone disclosed that an attacker obtained its factory WebAuth device authentication key used to verify hardware authenticity

An attacker in the October 20, 2026 Keystone breach accessed 25,964 buyer records from Keystone's Shopify store dating from 2024 to 2026, containing customer names, contact details, order information, and shipping addresses

Hardware wallet manufacturers Trezor and SafePal both disclosed customer data security breaches in August 2026

In July 2026, Coinkite warned Coinkite Coldcard users about a seed generation entropy defect that enabled cryptocurrency theft

Keystone confirmed that the compromised WebAuth key stolen in the October 20, 2026 breach is written permanently into hardware during factory production and cannot be erased or rewritten

Keystone's October 20, 2026 breach exposed an additional 12,873 uncompleted customer checkout records retained by Shopify for Keystone purchases

North Korean state cyber actors stole between six billion and eight billion dollars from cryptocurrency ecosystems between 2017 and 2025

Cc9f267dcClaimNews event

Keystone announced that it will destroy 18,835 unsold hardware wallets in its inventory to prevent potential counterfeit devices from passing online verification

Keystone froze unsent website orders and shifted online sales to preorders while manufacturing units with a newly generated WebAuth key

Keystone confirmed hardware wallets delivered before October 20, 2026, are safe if authenticity checks pass, but advised contacting support before initializing devices received with the old WebAuth key after October 20, 2026

Keystone stated that the WebAuth key stolen in the October 20 breach does not play a role in generating recovery phrases, deriving private keys, or signing cryptocurrency transactions

Keystone explicitly warned users that it will not request physical device returns and cautioned against scam messages claiming to offer device recalls or asset migrations

Cc9f267dcClaimNews event

Electrum maintainers released version 4.8.3 to add signature checks for wallet-owned unconfirmed transactions

Cc9f267dcNews eventClaim

An Electrum user operating a two-of-three multisignature Trezor setup submitted an incident report after noticing a substituted outgoing transaction in local history

Attackers running malicious Electrum servers generated lookalike receiving addresses matching the final four characters of legitimate payment destinations to deceive users checking transaction histories

An Electrum user named Raju-K12 reported on October 18, 2026 losing funds after increasing the transaction fee on a zero-fee transaction substituted by a malicious Electrum server