Crypto savings: with hardware wallets, where you buy becomes the risk
Keystone is destroying 18,835 devices after a breach, two weeks after tampered Ledger wallets from South-East Asia led to losses in the tens of millions.
The manufacturer Keystone reported on 26 October that attackers had taken not only 25,964 customer records but also the key its devices use to prove they are genuine. That would allow counterfeits that pass the authenticity check, which is why Keystone is destroying 18,835 devices from its inventory.
What happened
Hardware wallets are regarded as the safest way to hold crypto-assets privately, because the keys never leave the device. Both cases show that the weak point lies before the purchase. At Ledger, the company's own security lab found electronics added after manufacture to devices sold by CryptoBilis, a South-East Asian reseller; they captured the recovery phrase during set-up and sent it over the mobile network. The security chip itself was untouched, and by Ledger's own documentation its built-in authenticity check does not detect such add-ons. Independent analysts put the losses at $86m to $93m, which Ledger has not confirmed. MediaMarktSaturn withdrew Ledger devices as a precaution; no tampered device from a German store has been confirmed so far. Keystone's case differs: according to the company, recovery phrases and private keys are unaffected and no losses have been reported. But names, addresses and order details were stolen, which lend themselves to targeted fraud.
What follows
Assessment: the industry is responding by shortening supply chains. Ledger will sell its new device directly at first, Trezor is ending reseller partnerships according to trade reports, and Keystone is switching to new keys and pre-orders. For retailers, selling such devices becomes costlier and carries more liability. For owners, a passed authenticity test is no longer complete proof. Lost customer data gives fraudsters material for credible recall or verification offers. Keystone says it will not ask for devices back and that nobody needs to move funds. Keystone says it has reported the incident to authorities in the EU and Britain and will notify those affected individually. Whether there are further cases in Europe is unclear.
What changes in practice
- Hardware-wallet owners
- Buy devices only from the manufacturer or directly authorised sellers. Never enter a recovery phrase on a website, including for supposed verification.
- Keystone customers
- Devices delivered before 20 October are considered safe by the maker; those delivered later with the old key should be checked by support before use.
- Retailers
- Ledger bans the resale of returned devices and open shelf stock. Third-party sales face tighter controls.
What to watch
- Keystone's individual notifications and its announced lookup page
- Findings of the investigations into CryptoBilis and any further affected resellers
- Whether MediaMarktSaturn restocks Ledger devices, and on what conditions
Sources
- crypto.news: Keystone to destroy 18,835 hardware wallets after authentication key breach
- Bankless: Keystone breach widens as attacker grabs its device authentication key
- Keystone auf X: Sicherheitsmitteilung (26.10.2026)
- PC Games Hardware: Hardware-Wallet bei Media Markt, Spionageverdacht stoppt Verkauf
- PC-Welt: Media Markt Saturn nimmt manipuliertes Produkt aus seinem Angebot
- Decrypt: Ledger probes potential theft of $87M tied to crypto wallet reseller
- Cryptoticker: Ledger Atom, sold through its own shop only