Keystone Verification Key Theft Exposes 18,835 Hardware Wallets

Key points

• Attacker used website access to steal Keystone's device verification key.
• 18,835 hardware wallets are affected.
• Counterfeit devices could be trusted, enabling crypto theft.
• Wallet destruction is also listed among the incident actions.
• No CVE was assigned; the incident is dated October 26.

On October 26, Keystone reported that an attacker reached its website and removed a verification secret used by its hardware wallets. That secret helps confirm whether a device is genuine, so its loss changes the trust model for 18,835 wallets. No CVE identifier was issued for the event, which means defenders will not have a patch number to track and must rely on vendor guidance and device-level checks.

The immediate concern is counterfeit hardware: a fake unit could now appear legitimate to verification checks, increasing the chance that a user sends crypto assets to a compromised device. The incident also carries a crypto theft risk and includes wallet destruction, a step that could leave holders unable to recover funds. Keystone's customers should treat any device with uncertain provenance as suspect until authenticity is re-established.

Because the affected key is tied to device verification rather than a single software flaw, standard patching will not close the gap. Organizations that hold crypto assets—including school districts, staff, or affiliated programs—should review procurement records, confirm serial numbers through official channels, and avoid resellers with unclear supply chains. The 18,835 figure gives defenders a scope for outreach and inventory checks.

Watch for updated Keystone advisories, replacement or re-verification instructions, and any guidance on moving assets to newly generated wallets. Until then, isolate suspect devices, preserve logs, and escalate any sign of tampering or missing funds. The absence of a CVE does not mean the risk is only theoretical; it means the response is operational and vendor-led.

What to do now

1. Quarantine any Keystone hardware wallet received or purchased around October 26 until Keystone confirms its authenticity.
2. Verify device serial numbers and firmware only through official Keystone support channels, not links from email or resellers.
3. Move high-value crypto holdings to a newly generated wallet using a device from a trusted, verified source.
4. Preserve affected devices, packaging, and transaction logs; do not destroy evidence before security review.
5. Monitor Keystone advisories for replacement, re-verification, or wallet-destruction guidance and apply it promptly.
6. Review procurement records for the 18,835 affected wallets and contact holders with clear verification steps.
7. Warn staff and affiliated programs not to buy hardware wallets from third-party resellers with unclear supply chains.

Original source

The Hacker News