Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes
Summary
Keystone said it will destroy 18,835 unsold hardware wallets and pause shipping after an attacker obtained the secret key used to verify device authenticity, enabling counterfeit devices to pass its checks. The company also disclosed that 25,964 Shopify customer records containing names, contact details, addresses and order information were exposed; Amazon and other sales channels were unaffected. Keystone acknowledged that its automated data-deletion system failed, leaving some records past its retention period. It has reported the incident to authorities, shortened data retention to 90 days and warned customers about fake wallet-recall and migration offers. Website sales will resume as preorders once devices with a new key are produced.
