News about hardware wallets

Keystone will destroy 18,835 unsold hardware wallets and has suspended shipping of unshipped orders after an attacker obtained the permanent factory WebAuth key used to verify its devices are genuine, which could let counterfeit wallets pass its own check. The breach, detected October 20, exposed 25,964 buyer records from its Shopify store covering 2024 to 2026, including names, contact details and shipping addresses, but Keystone says recovery phrases and private keys were not involved and devices delivered before October 20 are unaffected. Keystone admitted that an automated deletion tool failed, leaving records that should have been erased under its 180-day policy. It has cut retention to 90 days and expects erasure to finish on November 3. The company also warned that scammers posing as 'recall' staff are asking customers to ship devices to them.

Hardware wallet maker Keystone said an attacker who breached its website last week also stole a key used to verify device authenticity, which could let counterfeit wallets pass its checks. The company plans to destroy 18,835 devices in inventory that contain the compromised key and has suspended shipments of devices using it. It disclosed that 25,964 buyer records from 2024 to 2026 were stolen after a faulty data-erasure tool failed to delete them, and that 12,873 checkout records held by Shopify were also taken. Devices made and delivered before the Oct. 20 incident are considered safe, but the authenticity of later devices cannot be guaranteed. The breach follows other security issues at hardware wallet makers this year, including Ledger, Coinkite and Trezor.

Ledger said LTE-enabled implants in wallets sold by CryptoBilis captured the 24-word recovery phrases shown on device screens during setup and sent them over cellular networks via an eSIM, without compromising the secure chips or altering transactions. The issue came to light after crypto losses involving devices sold through the reseller, which is listed as authorized in Indonesia, Malaysia and the Philippines. Blockchain investigator Specter estimated losses could exceed $86 million, while Yfarmx put them at $103 million, though Ledger has not confirmed a total. CryptoBilis halted sales of all hardware wallet brands in those three countries, Trezor said it received no reports of tampered devices but removed the reseller, and OneKey terminated its authorization and offered free replacements for devices bought from CryptoBilis in 2026. Ledger is also examining reports beyond the reseller, including European cases involving devices bought from MediaMarkt, but has not confirmed a link.