Crypto hardware-wallet maker Keystone has disclosed that an attacker who breached its website obtained the key its devices use to prove authenticity, and will destroy 18,835 unsold wallets that carry it. Keystone said on 26 October that it detected the unauthorised access on 20 October and blocked the attacker the same day; the intruder exploited a vulnerability in a third-party data-monitoring tool used by the website to escalate privileges, gaining customer data and the authentication key that backs the QR-code "Device Check" used to verify a wallet is genuine. Anyone holding the key could build counterfeit devices that pass the check — and a buyer who trusted a counterfeit could have their crypto stolen — though no counterfeit devices or corresponding thefts have been reported, and recovery phrases and private keys were not involved. All new devices will ship with a replacement key; owners of devices delivered after 20 October with the old key are asked to contact support before trusting the check.

• Source article