Keystone Hardware Wallet Supply Chain Attack
Attackers stole Keystone's factory-burned WebAuth key — the master key used to verify device authenticity — forcing the company to destroy 19,000 devices in inventory and invalidating the authenticity check on all devices in the wild.
What we know
@toly reacted with alarm to the news, quoting an account on X's report that Keystone confirmed the stolen key is the exact one burned into every device at the factory. Another account on X explained the full severity: the key can't be replaced, meaning 19,000 devices in inventory must be physically destroyed, and all existing wallets now have their authenticity verification compromised. The timing amplifies Toly's longstanding advice on supply-chain diversity in cold wallet setups, which he reiterated across multiple tweets (@toly and @toly).
Sources
“Pls say it ain't so — reacting to Keystone WebAuth key compromise”
View post →By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.