Keystone reported a breach of its webshop on October 24.
Names, contact details, shipping addresses and order details were taken.
According to Keystone, seeds, private keys and payment data were not...
Worth adding Keystone's later update (Oct 26, covered by Cointelegraph Oct 27), because it changes the "your bitcoin is fine" part for some buyers:
- The attacker came in through a third-party monitoring tool on the site and also took the WebAuth key, the key that makes a device pass Keystone's authenticity check. Counterfeits could now pass that check.
- Devices made and delivered before Oct 20 are still considered safe. Devices delivered after Oct 20 can't be guaranteed; Keystone asks those buyers to contact support for extra verification.
- They are destroying 18,835 unsold devices with the old key and paused shipments until new-key units exist.
- Scope: 25,964 buyer records (2024-2026, kept past the 180-day limit because a deletion tool failed) plus 12,873 unfinished checkouts held by Shopify.
So: bought before Oct 20, your advice stands. Received one after Oct 20, check with [email protected] before putting funds on it.
- The attacker came in through a third-party monitoring tool on the site and also took the WebAuth key, the key that makes a device pass Keystone's authenticity check. Counterfeits could now pass that check.
- Devices made and delivered before Oct 20 are still considered safe. Devices delivered after Oct 20 can't be guaranteed; Keystone asks those buyers to contact support for extra verification.
- They are destroying 18,835 unsold devices with the old key and paused shipments until new-key units exist.
- Scope: 25,964 buyer records (2024-2026, kept past the 180-day limit because a deletion tool failed) plus 12,873 unfinished checkouts held by Shopify.
So: bought before Oct 20, your advice stands. Received one after Oct 20, check with [email protected] before putting funds on it.
2❤️1
