Oh my god, the key used to prove "this hardware wallet is genuine" has been stolen by hackers. On October 26th, Keystone announced that attackers had obtained the factory verification key written into every device, and the company decided to destroy all 18,835 wallets in its warehouse that hadn't yet been sold. Many people may not realize what this means: someone might sell you a fake Keystone, and it could pass official verification. The story begins on October 20th. According to reports from The Hacker News and other foreign media outlets, Keystone discovered anomalies on its website that day. Attackers exploited a vulnerability in a third-party data monitoring tool on the website to escalate privileges and steal customer data and the verification key. The company patched the vulnerability that day and later fixed it. Last weekend, they first admitted that customer shipping information had been leaked, which everyone initially thought was just another address leak. However, on Monday, they added the more serious statement: the verification key was also gone. The impact affected 25,964 buyer records from 2024 to 2026 on the official website, including names, contact information, shipping addresses, and order details. An additional 12,873 unpaid checkout records were also included. To make matters worse, this data was supposed to be deleted after 180 days, but the bulk deletion tool was unreliable, and some deletions quietly failed. Keystone itself admitted to not deleting on time and is willing to take responsibility. What exactly does this key do? According to reports, when you verify a device, you scan the QR code on the official website's verification page with your wallet. The device uses its built-in key to decrypt a verification code, which you enter back on the webpage. If it matches, it proves the device is genuine. The key is hardcoded at the factory and cannot be erased or rewritten. Therefore, the 18,835 already manufactured devices cannot have their locks changed and must be destroyed. Orders on the official website that have not yet been shipped are also temporarily suspended until devices with the new key are installed. The good news is that this key is only responsible for verification and does not participate in generating mnemonic phrases, deriving private keys, or signing transactions. Keystone states that users' mnemonic phrases and private keys are unaffected, and there's no need to transfer funds due to this issue. There have also been no reports of counterfeit devices or theft. The real risk lies ahead. Let's say you see a "brand new, unopened" Keystone device online this week, slightly cheaper than on the official website, and it passes the power-on verification. You'd likely feel comfortable transferring your funds into it. However, this "passing" verification can be easily accomplished by anyone with the key. Adding a list of buyers with names and addresses effectively tells others who might have funds. This isn't the first time hardware wallet vendors have run into trouble. Decrypt mentioned that in 2020, the Ledger customer list leak affected approximately 292,000 people. In August of this year, Trezor and SafePal also had their customer data leaked, affecting 13,689 and approximately 39,798 users respectively. Chainalysis estimates that there will be 46 brute-force attacks targeting cryptocurrency holders in the first half of 2026, resulting in the theft of over $30 million. What you can do now is actually quite simple. Devices received and verified before October 20th can still be used normally. For those received after the 20th, don't deposit any coins; contact official customer service for confirmation. From now on, any calls, text messages, emails, or even paper letters claiming to be for recalls, replacements, asset migrations, or wallet verification should be considered scams. Keystone has already stated that it will not require anyone to return devices. My view is that the most ironic thing about this is that people buy hardware wallets to avoid trusting others, but their first line of trust is precisely placed on the vendor's key. When buying cold wallets in the future, the source is far more important than the price. Don't buy "brand new" devices of dubious origin just to save a little money. Where did you buy your hardware wallet? From the official website, e-commerce platforms, or a friend's reseller? Other key points for today are shown in the image. Hardware Wallets: Keystone Crypto Daily Briefing