Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.
Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone.
A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve owners' recovery phrases or wallet private keys.
Keystone will destroy 18,835 unsold devices that carry the key, and all new devices will get a new one; keystone found the unauthorized access on October 20, and its advice to owners depends on when a device arrived.
For a device received after that date with the old key, the company said: Owners of such a device should contact Keystone support and use it only after the company confirms it is genuine.
A device delivered before October 20 that passes the check can be considered genuine and used normally, according to Keystone.
The attacker exploited a vulnerability in a third-party data monitoring tool used by Keystone's website to escalate privileges, according to the company.
Keystone blocked the attacker's access on October 20 and has since fixed the vulnerability.
Anyone with a copy of the key could produce the right codes, so a counterfeit device carrying it could pass the check; the records hold names, contact details, shipping addresses, and order details.
Keystone has also included 12,873 unpaid checkout records in its response as a precaution, and these hold names, contact details, and shipping information from purchases that were never completed.
What happened
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.
Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone.
A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve owners' recovery phrases or wallet private keys.
What changed
Keystone will destroy 18,835 unsold devices that carry the key, and all new devices will get a new one; keystone found the unauthorized access on October 20, and its advice to owners depends on when a device arrived.
Who is affected
For a device received after that date with the old key, the company said: Owners of such a device should contact Keystone support and use it only after the company confirms it is genuine.
A device delivered before October 20 that passes the check can be considered genuine and used normally, according to Keystone.
Why it matters
The attacker exploited a vulnerability in a third-party data monitoring tool used by Keystone's website to escalate privileges, according to the company.
Keystone blocked the attacker's access on October 20 and has since fixed the vulnerability.
Response
Anyone with a copy of the key could produce the right codes, so a counterfeit device carrying it could pass the check; the records hold names, contact details, shipping addresses, and order details.
What security teams should do
Keystone has also included 12,873 unpaid checkout records in its response as a precaution, and these hold names, contact details, and shipping information from purchases that were never completed.
What remains unknown
The company has not said when the attacker first got in.
It has not said where the key was stored.
Attribution
The Hacker News: An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.