Incidents
Keystone’s October 2026 breach: what wallet owners should check
By Jolly Ledger editorial · Published · Reviewed · 3 min read
Event date: 20 October 2026; statement published 26 October 2026
Dated incident snapshot. Editorial review: 27 October 2026. This explainer reflects sources reviewed on that date. Open the original notice for subsequent updates before acting.
Short answer
Keystone reported theft of customer information and a device authentication key, not customers’ recovery phrases or private keys. Its guidance distinguishes devices delivered before 20 October from old-key devices received afterward.
Keystone’s 26 October statement describes two different exposures: customer information and a key used to authenticate devices. Neither should be confused with the private keys that authorize a customer’s transactions. This article reflects that statement and its reporting as reviewed on 27 October, not an independent forensic investigation.
What Keystone says was taken
Keystone says it detected unusual website access on 20 October. According to the statement, an attacker exploited a third-party monitoring tool to obtain customer information and the device authentication key. The company says recovery phrases, wallet private keys and other wallet credentials were not involved.
The statement identifies buyer records containing personal information plus a separate set of unpaid checkout records. These are record counts, not a count of compromised wallets. Names, contact information and shipping details can nevertheless support convincing impersonation.
Why the authentication key matters
According to Keystone, the stolen key is used for device authenticity checks, not recovery phrase generation, private key derivation or transaction signing. Its theft could allow counterfeit devices to pass that check. This describes a capability and risk; it does not establish that counterfeit devices have reached customers.
Keystone announced that 18,835 unsold devices containing the old key would be destroyed and that manufacturing would switch keys. That inventory action is not a statement that every customer device was compromised. See the broader limits of authenticity checks.
Match your situation to the dated guidance
- Find your delivery date and purchase records without sharing wallet secrets.
- For devices delivered before 20 October, consult Keystone’s statement, which says their authentication is unaffected.
- For old-key devices received after 20 October, follow Keystone’s support verification process even if the authenticity check passes.
- If your delivery date falls on the boundary or the key version is unclear, ask verified Keystone support rather than guessing.
Respond without following a fake recall
Navigate to Keystone’s official site yourself to find support. Its statement says owners do not need to transfer assets solely because of this incident. Preserve suspicious messages, do not install tools they offer, and never disclose recovery words. Use the breach triage guide to separate an exposure notice from evidence about your own wallet, and read how to spot a fake recall.
Sources
- Statement Regarding the Security Incident on Our Official Website and Customer Guidance — KeystoneOfficial statement dated 26 October 2026; incident scope and device guidance are attributed to Keystone.
- Keystone to destroy 18,835 wallets after device authentication key theft — The DefiantSecondary reporting of the statement.
Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.
Prepare for the next disruption
This checkup cannot diagnose a current compromise or tell you whether funds are at risk. It helps you prepare: backups, official instructions and a family briefing.
Start the free preparation checkup