ChainThink report, October 26: According to an official announcement, the hardware wallet provider Keystone disclosed that attackers exploited a vulnerability in a third-party data monitoring tool on its official website to obtain WebAuth keys used for device authenticity verification, potentially enabling the production of counterfeit devices capable of passing verification.

Keystone has ceased using the old keys for manufacturing, will destroy 18,835 units in inventory that were produced with the compromised keys, and has suspended all undelivered orders on its official website, switching to a pre-sale model instead.

Keystone stated that devices received and verified before October 20 can be used normally; devices received after October 20 that use the old keys, even if they pass verification, must be further verified by contacting customer support, and users are not required to return the devices.

This incident involves 25,964 Shopify purchase records still containing personal information, as well as 12,873 checkout records from uncompleted payments.

Keystone noted that this information was originally scheduled for deletion after 180 days but remained retained beyond the deadline due to a failure in the automated deletion tool. The retention period for personal data has now been shortened to 90 days. Mnemonic phrases, private keys, and payment information were not compromised.