--- title: "Keystone to destroy 18,835 Bitcoin wallets after factory key theft" description: "Keystone said it will destroy 18,835 unsold Bitcoin hardware wallets and pause shipping after attackers obtained the factory WebAuth key used to prove…" language: en canonical: "https://whycoinmoves.com/en/events/bitcoin-bitcoin-wallet-maker-keystone-pulls-8b5c3ef3b471a6" published: 2026-10-27T18:18:57.000Z updated: 2026-10-27T19:19:02.000Z indexable: true --- # Keystone to destroy 18,835 Bitcoin wallets after factory key theft Keystone said it will destroy 18,835 unsold Bitcoin hardware wallets and pause shipping after attackers obtained the factory WebAuth key used to prove… Attributed sources: [Decrypt]() ## Key facts Keystone said it will destroy 18,835 unsold Bitcoin hardware wallets and pause shipping after attackers obtained the factory WebAuth key used to prove devices are genuine, Decrypt reported. The company said 25,964 buyer records still holding names, contact details, shipping addresses and order information were affected, and that recovery phrases and private keys were not involved. Evidence strength: Single source, 1 publisher group(s) (Decrypt). After site detection, observed returns were 5 minutes: +0.08% (Oct 27, 2026, 18:18 → Oct 27, 2026, 18:23, UTC; Gate · USDT); 1 hour: +0.03% (Oct 27, 2026, 18:18 → Oct 27, 2026, 19:18, UTC; Gate · USDT) In the preceding 30 days, the 99th percentile of absolute hourly returns was 1.01% (OKX · USDT; cutoff Oct 27, 2026, 18:18, UTC). ## Returns after site detection | Window | Return | BTC | Difference from BTC | Actual sampled interval (UTC) | Source | | --- | --- | --- | --- | --- | --- | | 5 minutes | +0.08% | +0.08% | 0.00 pp | Oct 27, 2026, 18:18 → Oct 27, 2026, 18:23 | Gate · USDT | | 1 hour | +0.03% | +0.03% | 0.00 pp | Oct 27, 2026, 18:18 → Oct 27, 2026, 19:18 | Gate · USDT | ## Historical hourly baseline | Metric | Value | | --- | --- | | Coverage | 100.0% (720/720) | | Median absolute hourly return | 0.15% | | 99th percentile of absolute hourly returns | 1.01% | | BTC beta | 1.00 | | Source / cutoff (UTC) | OKX · USDT / Oct 27, 2026, 18:18 | ## Claims and open questions - Keystone said it will destroy 18,835 unsold devices after attackers obtained the WebAuth key written into each device at the factory, which the company said could let an attacker produce counterfeits that pass its authentication checks. - Keystone said 51,083 buyer records were involved in the Shopify store breach, but 25,119 had already been erased, leaving 25,964 records from 2024 to 2026 with names, contact details, shipping addresses and order information. - Keystone said it failed to fulfill its commitment to erase customer data on time because some automated erasure tasks failed and the failures went undetected, and it accepted responsibility for the failure. - Who carried out the attack, and when the attacker first gained access to the factory key and customer records, according to Keystone's own account. - Whether Keystone has notified affected buyers directly and what replacement or remediation it will offer for orders placed through its website. ## Source evidence - [Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes]() — Decrypt; published Oct 27, 2026, 18:16; received Oct 27, 2026, 18:18 (UTC). ## Recent BTC events and market reactions - [CFTC reportedly reopens Polymarket inquiry over US user access]() — Published Oct 27, 2026, 18:29 (UTC) · Single source (1 publisher) · Regulation · 5m +0.09% / 1h +0.08% - [Crypto industry spends about $176 million across more than 100 midterm races]() — Published Oct 27, 2026, 14:34 (UTC) · Single source (1 publisher) · Regulation · 5m +0.04% / 1h +0.17% - [Luxor raises $16 million to expand AI compute trading and hardware business]() — Published Oct 27, 2026, 13:01 (UTC) · Multiple publishers (5 publishers) · Market watch · 5m -0.13% / 1h -0.37% - [Bitcoin trades below $80,000 as analysts flag near-term weakness]() — Published Oct 27, 2026, 12:00 (UTC) · Single source (1 publisher) · General news · 5m -0.02% / 1h +0.54% - [Electrum patches flaw that let rogue servers redirect fee-bumped payments]() — Published Oct 26, 2026, 17:41 (UTC) · Single source (1 publisher) · Security · 5m -0.12% / 1h -0.13% / 24h +0.54% - [Full coin archive]() ## Research for this archive - [Crypto hacks and price impact: Bybit and Cetus case studies]() - [Why is crypto moving? How to check the evidence behind a price explanation]() - [Altcoin beta to Bitcoin: BTC, ETH, SOL and DOGE hourly returns]() - [Will Bitcoin go back up? Every crash since 2011 and its recovery time]() Evidence levels describe source coverage, not the probability that a report is true. Price moves and their timing cannot establish a cause; minute samples show an observed interval and alert thresholds are heuristics. Explanations are model-assisted, with citations and figures checked. Source titles stay in their original language; full articles are not republished. [Methods and limitations]()