Keystone breach deepens: Hackers stole key used to verify wallets as genuine

Hardware wallet maker Keystone said an attacker who breached its website last week also stole a key used to verify the authenticity of its devices, widening the scope of an incident initially disclosed as a customer data leak.

In a statement Monday, Keystone said the stolen authentication key could allow attackers to produce counterfeit wallets that pass its authenticity checks.

“These devices could then be sold or shipped to customers, who might unknowingly use them as genuine products, potentially resulting in asset theft,” Keystone said.  

The incident adds to a series of attacks targeting hardware wallet manufacturers this year. 

Earlier this month, Ledger asked resellers across Southeast Asia and Hong Kong to suspend sales following reports that devices sold in the region contained unauthorized implants capable of capturing recovery phrases.

In late July, Coldcard manufacturer Coinkite issued a warning to users after attackers exploited a bug that caused its devices to generate wallet seeds with less entropy than intended, resulting in the theft of millions of dollars in crypto.

Keystone to destroy more than 18,000 devices with old key

In its latest update, Keystone said the attacker exploited a vulnerability in a third-party monitoring tool used by its website to escalate privileges.