On October 26, 2026, Bitcoin hardware wallet manufacturer Keystone disclosed that an attacker obtained its factory WebAuth device authentication key used to verify hardware authenticity

Overview Debates Related claims Topics Sources

Keystone stated that hardware wallets manufactured and delivered before October 20, 2026, remain safe and that their private keys and recovery phrases were not compromised

Keystone announced on October 26, 2026, that it will destroy 18,835 unsold hardware wallet devices in its inventory carrying the compromised WebAuth key stolen in the October 20, 2026 breach

Keystone stated that the WebAuth key stolen in the October 20, 2026 breach allows attackers to manufacture counterfeit hardware wallets that pass official authenticity checks, creating a risk of asset theft for buyers

An attacker in the October 20, 2026 Keystone breach accessed 25,964 buyer records from Keystone's Shopify store dating from 2024 to 2026, containing customer names, contact details, order information, and shipping addresses

Hardware wallet manufacturers Trezor and SafePal both disclosed customer data security breaches in August 2026

Keystone attributed the retention of exposed customer data to a failure in its automated bulk-erasure tool, which failed to execute data deletion beyond its 180-day retention policy

Keystone suspended all hardware wallet production shipments on October 26, 2026, pending the manufacturing of new devices using an updated authentication key

In July 2026, Coinkite warned Coinkite Coldcard users about a seed generation entropy defect that enabled cryptocurrency theft

Keystone confirmed that the compromised WebAuth key stolen in the October 20, 2026 breach is written permanently into hardware during factory production and cannot be erased or rewritten

Keystone's October 20, 2026 breach exposed an additional 12,873 uncompleted customer checkout records retained by Shopify for Keystone purchases

Keystone transitioned website sales to preorders and submitted breach reports to regulatory authorities in the European Union, United Kingdom, and other jurisdictions

North Korean state cyber actors stole between six billion and eight billion dollars from cryptocurrency ecosystems between 2017 and 2025

An intruder who breached Keystone's website on October 20, 2026, obtained a WebAuth key used during manufacturing to verify device authenticity, which cannot be erased or rewritten once burned into hardware

Keystone froze unsent website orders and shifted online sales to preorders while manufacturing units with a newly generated WebAuth key

Keystone confirmed hardware wallets delivered before October 20, 2026, are safe if authenticity checks pass, but advised contacting support before initializing devices received with the old WebAuth key after October 20, 2026

Keystone stated that the WebAuth key stolen in the October 20 breach does not play a role in generating recovery phrases, deriving private keys, or signing cryptocurrency transactions

Keystone explicitly warned users that it will not request physical device returns and cautioned against scam messages claiming to offer device recalls or asset migrations

Cc9f267dcClaimNews event

Electrum maintainers released version 4.8.3 to add signature checks for wallet-owned unconfirmed transactions

Cc9f267dcNews eventClaim

An Electrum user operating a two-of-three multisignature Trezor setup submitted an incident report after noticing a substituted outgoing transaction in local history

Attackers running malicious Electrum servers generated lookalike receiving addresses matching the final four characters of legitimate payment destinations to deceive users checking transaction histories