If your Keystone hardware wallet arrived before October 20 and passes the device authentication check, the company says it is safe to keep using. The 18,835 units being destroyed are unsold inventory. Keystone disclosed on October 26 that attackers who breached its website also obtained the device authentication key, the key that proves a Keystone wallet is genuine, according to Bitcoin.com News. That key is set at manufacture and cannot be changed or erased, so anyone holding it could build counterfeit wallets that pass the authenticity check. Every stocked device carrying the key will be destroyed, and new units will ship with a replacement. Devices received after October 20 that use the compromised key need extra verification through customer support, even if they pass the check. Keystone says recovery phrases, private keys, wallet credentials and payment details were not exposed, and it is not telling customers to move funds because of the incident. Buyer data was exposed: of 51,083 Shopify records reviewed, 25,964 still held names, shipping addresses, contact details and purchase history from 2024 to 2026, because an automated deletion system failed to clear them after 180 days. "We failed to fulfill our commitment to erase customer data on time, and we accept responsibility for this failure," the company said. The breach came through a flaw in a third-party monitoring tool, first spotted on October 20. Shipments of website orders are paused in favor of preorders. Expect fake recall messages asking you to return your device, and ignore them.