Timeline so far:

- Oct 20: Keystone detects an intrusion on its website

- Oct 24: discloses a customer data leak (names, addresses, order records)

- Oct 26: reveals the attacker also got the WebAuth key used to verify devices as genuine

That key is burned into devices at the factory and can't be changed, so in theory it could let counterfeit wallets pass Keystone's authenticity check. Keystone is destroying 18,835 devices in stock and holding orders until new ones ship with a new key.

Not affected: recovery phrases, private keys, wallet passwords.

Keystone says devices verified before Oct 20 are considered safe. If you got one after Oct 20, they ask you to contact support. And with names and home addresses leaked, expect fake "Keystone support" refund scams. Never type your seed phrase anywhere.

Anyone here using a Keystone? Sticking with it?