Keystone suspended all hardware wallet production shipments on October 26, 2026, pending the manufacturing of new devices using an updated authentication key

Overview Debates Related claims Topics Sources

Keystone stated that hardware wallets manufactured and delivered before October 20, 2026, remain safe and that their private keys and recovery phrases were not compromised

Keystone announced on October 26, 2026, that it will destroy 18,835 unsold hardware wallet devices in its inventory carrying the compromised WebAuth key stolen in the October 20, 2026 breach

Keystone stated that the WebAuth key stolen in the October 20, 2026 breach allows attackers to manufacture counterfeit hardware wallets that pass official authenticity checks, creating a risk of asset theft for buyers

On October 26, 2026, Bitcoin hardware wallet manufacturer Keystone disclosed that an attacker obtained its factory WebAuth device authentication key used to verify hardware authenticity

An attacker in the October 20, 2026 Keystone breach accessed 25,964 buyer records from Keystone's Shopify store dating from 2024 to 2026, containing customer names, contact details, order information, and shipping addresses

Hardware wallet manufacturers Trezor and SafePal both disclosed customer data security breaches in August 2026

Keystone attributed the retention of exposed customer data to a failure in its automated bulk-erasure tool, which failed to execute data deletion beyond its 180-day retention policy

In July 2026, Coinkite warned Coinkite Coldcard users about a seed generation entropy defect that enabled cryptocurrency theft

Keystone confirmed that the compromised WebAuth key stolen in the October 20, 2026 breach is written permanently into hardware during factory production and cannot be erased or rewritten

Keystone's October 20, 2026 breach exposed an additional 12,873 uncompleted customer checkout records retained by Shopify for Keystone purchases

Keystone transitioned website sales to preorders and submitted breach reports to regulatory authorities in the European Union, United Kingdom, and other jurisdictions

Keystone froze unsent website orders and shifted online sales to preorders while manufacturing units with a newly generated WebAuth key

Keystone confirmed hardware wallets delivered before October 20, 2026, are safe if authenticity checks pass, but advised contacting support before initializing devices received with the old WebAuth key after October 20, 2026

Cc9f267dcClaimNews event

Electrum maintainers released version 4.8.3 to add signature checks for wallet-owned unconfirmed transactions

Cc9f267dcNews eventClaim

An Electrum user operating a two-of-three multisignature Trezor setup submitted an incident report after noticing a substituted outgoing transaction in local history

Attackers running malicious Electrum servers generated lookalike receiving addresses matching the final four characters of legitimate payment destinations to deceive users checking transaction histories

An Electrum user named Raju-K12 reported on October 18, 2026 losing funds after increasing the transaction fee on a zero-fee transaction substituted by a malicious Electrum server

In one documented attack against user dannydeezy, a rogue Electrum server's substituted transaction matched dannydeezy's original transaction's inputs and locktime while directing funds to a fake destination ending in GyQ3

Electrum version 4.8.3 checks signatures only on wallet-owned inputs, leaving unconfirmed incoming transactions unchecked because the client lacks a full script interpreter

Keystone Hardware Wallet confirmed that sensitive cryptographic credentials, including seed recovery phrases and private keys, remained unexposed during the October 20, 2026 unauthorized access to its website