Independent DeFi security desk · Status: operationalMethodology & corrections · Submit an incident
DDeFi Safety ToolsNEWS · DATA · PRACTICAL SAFETYGet the briefing
DeFi Safety · Fact checked

Keystone to destroy 18,835 hardware wallets after authentication key breach

Hardware wallet manufacturer Keystone has confirmed that hackers stole a device authentication key and exposed personal information belonging to 25,964 customers, forcing the company to destroy 18,835 devices and…

By DeFi Tools Guide Editorial Team · Published Oct 26, 2026, 2:40 PM UTC · Updated 2026-10-26 · Risk level: medium
Sources checked: Oct 26, 2026, 7:11 PM UTC

This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.

DeFi Safety — illustration keyed to this article's identifier. Source documents are listed under Sources and are not reproduced here.

What happened

Hardware wallet manufacturer Keystone has confirmed that hackers stole a device authentication key and exposed personal information belonging to 25,964 customers, forcing the company to destroy 18,835 devices and suspend shipments.

Reported details

  • Owners of old-key devices received after Oct. 20 need additional authenticity checks, even if the wallet passes Keystone’s online verification.

Why this matters

Whether Keystone reaches the custody and settlement layer depends on what it actually names. If it points at a custodian, a redemption term or a withdrawal rule, that is the layer where exposure lives, and the name and its timing are the parts worth checking. If it names none of those, this angle simply does not apply here, and reading custody risk into it would be an assumption rather than a finding.

Evidence boundary

On Keystone, the scope is limited to what the linked 2 reports state, and where they diverge both positions are recorded without either being picked in advance; the headline figure is what to check first.

What to verify

If Keystone names a custodian or a redemption term, check that name and its timing against the operator’s own documentation; if it names neither, there is nothing here to verify on that layer.

Sources and editorial check time

This information is educational and is not financial, legal, or tax advice.

Sources