Odaily reports: Bitcoin hardware wallet manufacturer Keystone has stated that attackers obtained the permanent factory keys used to verify device authenticity. The company will destroy 18,835 unsold devices in its inventory and suspend all unshipped orders on its official website. The incident was discovered on October 20. Devices delivered before October 20 are not affected, and mnemonic phrases and private keys were not involved.
The incident also affected 25,964 buyer records from Keystone's Shopify online store, involving names, contact information, shipping addresses, and order information between 2024 and 2026. A total of 51,083 records were previously involved, and 25,119 pieces of personal information have been deleted; customers who purchased through channels such as Amazon are not affected.
Keystone stated that some records were not deleted within the originally planned 180-day period. The company has shortened the data retention period to 90 days and on October 24 requested that Shopify delete overdue data, which is expected to be completed on November 3. Official website sales will switch to pre-orders until devices using the new keys are produced; the company has submitted reports to relevant authorities in the EU, the UK, and other regions. (Decrypt)
