Keystone breach deepens: Hackers stole key used to verify wallets as genuine
Keystone initially disclosed a leak of customer information but has since disclosed that hackers also stole a key that could allow counterfeit wallets to pass authenticity checks.
The security breach at Keystone, a hardware cryptocurrency wallet manufacturer, has proven more severe than initially reported. The company first disclosed that hackers had obtained customer information, but has since confirmed that the attackers also stole a cryptographic signing key used to verify the authenticity of Keystone devices. The possession of this key means bad actors could potentially produce counterfeit wallets that pass official authenticity checks, placing users at significant risk.
Keystone hardware wallets are designed to store private keys offline, offering users a layer of security against online threats. A core feature of such devices is an authenticity verification system that allows buyers to confirm they have received a genuine product rather than a tampered or counterfeit unit. The theft of the signing key directly undermines this safeguard, effectively neutralizing one of the device's primary trust mechanisms.
The incident highlights a broader vulnerability in the hardware wallet supply chain, where physical device integrity is as critical as software security. If counterfeit wallets embedded with malicious firmware can pass authenticity checks, users may unknowingly expose their private keys and digital assets to theft. This development is likely to prompt scrutiny across the hardware wallet industry regarding how manufacturers protect their cryptographic verification infrastructure.
Keystone has not yet publicly detailed a remediation plan for the compromised signing key. Users who have recently purchased or plan to purchase a Keystone device are advised to monitor the company's official communications closely for further guidance.
Source: Cointelegraph
