Zero Radar
← feed
HighSecurity incidentupdated 27 Oct 2026, 12:17 UTC

Keystone hardware wallet verification key stolen; 18,835 devices to be destroyed

Attackers got a secret key that proves Keystone crypto wallets are genuine. With that key they could make fake wallets that look real, so buyers could lose their crypto.

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doCheck exposureOnly buy or trust Keystone wallets from official, verified sources and follow Keystone's guidance on your device.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker breaches websiteGains access to Keystone's website
  2. 2Verification key stolenKey proves devices are genuine
  3. 3Counterfeit devices builtFakes pass the online authenticity check
  4. 4Buyer trusts fakeOwner believes the device is genuine
  5. 5Crypto at riskFunds could be stolen by the counterfeit
  6. ResultCounterfeit wallets could steal buyers' crypto

What happened

An attacker who accessed Keystone's website obtained the device verification key used by Keystone hardware wallets to prove authenticity, enabling counterfeit devices to pass the online authenticity check.

Why it is dangerous: Buyers who trust a counterfeit Keystone wallet could have their cryptocurrency stolen. The company is destroying 18,835 devices as a precaution.

Are you affected?

You are affected if you own or are considering buying a Keystone hardware wallet, especially one bought from a source other than Keystone directly.

Keystone hardware wallets whose verification key was obtained (device count: 18,835, to be destroyed by the company).

What to do

  1. Buy Keystone wallets only directly from Keystone's official site or authorized sellers
  2. Check whether your device came from a trusted source before trusting its authenticity check
  3. Follow Keystone's official statement for replacement or next steps

Timeline

  1. 27 Oct 2026, 11:46 UTC
    Publicly disclosed
  2. 27 Oct 2026, 11:46 UTC
    Reported by The Hacker News · The Hacker News
  3. 27 Oct 2026, 12:17 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-3fba9192
Disclosed
27 Oct 2026, 11:46 UTC
On Zero Radar
27 Oct 2026, 12:17 UTC (32 min after disclosure)
Last change
27 Oct 2026, 12:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Keystone hardware wallet verification key stolen; 18,835 devices to be destroyed · Zero Radar