Crypto wallet manufacturer Keystone will destroy nearly 19,000 devices and pause shipments after a website vulnerability led to the exposure of customer data and authentication keys. The company announced on Monday via X that an attacker accessed its website on October 20 through a vulnerability in a third-party data monitoring tool, resulting in the leak of 25,964 buyer records (including names, contact information, shipping addresses, and order details) and a critical key that could allow counterfeit wallets to pass authenticity verification. Keystone stated that the breach did not expose recovery phrases, private keys, or wallet credentials, but some customer records were not deleted in a timely manner according to its 180-day policy due to a malfunction in an automated deletion tool. The company will destroy 18,835 unsold devices using the old key, convert website sales to pre-orders, and shorten customer data retention to 90 days.