Keystone announced that a breach of its website exposed a device verification key, and that it will destroy 18,835 unsold devices due to the risk that counterfeit hardware wallets could pass authenticity checks.
The latest investigation findings reported by Wu Blockchain revealed that the security breach at the hardware wallet manufacturer extended beyond customer records. The company said attackers obtained the WebAuth device verification key through the website breach.
According to Keystone, this key could allow counterfeit hardware wallets to pass the company’s official authenticity check. This puts the reliability of the check users rely on to determine whether the device they purchased is a genuine Keystone product at risk.
18,835 devices to be destroyed; shipments to be halted
The company announced that it will destroy 18,835 unsold devices that use the old verification key. Orders that have not yet shipped will be halted, and a different verification key will be used in new production.
The breach also affected 25,964 purchase records and 12,873 incomplete payment records. In the incident that previously made headlines over the leak of customer data, the latest announcement revealed a new risk related to verifying device authenticity.
What did the company say about users’ private keys?
Keystone said that recovery phrases, private keys, and the transaction signing process were not affected. The key that was reportedly compromised is used to verify a device’s authenticity; it serves a different function from the private keys that give users access to their crypto assets.
Not investment advice.