The fallout from a recent Keystone website security incident has spread beyond customer data. Besides exposing 25,964 customer records, the breach gave attackers the device verification keys, which could be used to build counterfeit hardware wallets that pass the official website check.

Keystone is destroying 18,835 devices from inventory that carry the compromised keys.

Shipments of unfulfilled orders are paused until devices with a new key enter production, and customer data retention is cut from 180 to 90 days. Users who received a device with an old key after October 20 are asked to contact support for extra authentication, since passing the online check alone no longer rules out a counterfeit.