Johnny Kelly ($intertreejk)

Keystone fam, Here's an update on some of the actions we promised and how to protect yourself from phishing. Where things stand: - We cut shipping data retention from 180 to 90 days, effective now. - Want your data gone sooner? Once your order arrives, contact our support team, and we'll delete it right away. - We emailed every affected user from [email protected]. - We paused all shipments and began quarantining affected devices at every warehouse we use, including Amazon's. - We're answering your questions here on X and through support tickets. Thank you to everyone who shared feedback on the lookup page for affected users. We're working through every concern to make it as secure as possible. Stay safe from phishing: - Incident emails only come from [email protected]. Check the sender every time. - We will never ask for your seed phrase. Not by email, DM, or phone. - If a message pushes you to act fast, stop and check with us first. We'll share more on next steps in the coming days. Again, we're sorry we let this happen. We're doing everything we can to make it right and to help every affected user through it. Questions, or think we missed something? Drop them in the replies.

Dear Keystone fam, We know this has been a stressful week, and many of you have questions. Here are answers to the ones we’re hearing most. → I bought my device in 2024/2025/2026. Am I affected? If you placed an order from 2024 to 2026, your shipping data may have been exposed. We’re building a page where you can check whether you’re affected, and we’ll share it here as soon as it’s live. → The authentication key was exposed. How can I verify a device delivered before Oct 20? Our device verification page still runs on the old authentication key, so you can still use it to verify an unopened Keystone. The attacker has that key now, but it doesn’t affect devices that were already delivered before Oct 20. → I already use my Keystone. Can I keep using it? Yes. If you received it before Oct 20, verify it on our website and keep using it as normal. → I received my device on/after Oct 20. What should I do? With the key exposed, attackers could build a fake device with the real key inside, making it look genuine. Contact our support team right away at [email protected], and they’ll walk you through the next steps. → My order is in transit. What should I do? Refuse the package when it arrives and email us at [email protected]. Our support team will help you from there. → Is it safe to place a new order on your website? Yes. Because of the key leak, we’ve set aside all existing Keystone 3 Pro inventory to be destroyed. Any order you place now is a pre-order from a fresh batch with new authentication keys, expected to arrive in 4 to 6 weeks. If you’re OK with the wait, go ahead and order. → Is it still safe to update my Keystone’s firmware? Yes. Your Keystone only installs firmware signed by our team. The key that leaked is our web authentication key, which is completely separate from our firmware signing key. Firmware updates are safe, so you can update and keep using your device as normal. ⚠️ Remember, scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or “fixes” for your order or address. None of it is from us. We will never ask for your recovery phrase or private keys. NEVER share them with anyone, and NEVER enter your recovery phrase into a device you didn’t order. Don’t click links in messages you weren’t expecting. Type keyst.one into your browser yourself. Need help? Reach us directly here on X or at [email protected] Once again, we’re sorry we let this happen. We’re doing everything we can to make it right and to help every affected user through it. Still have questions, or think we missed something? Drop them in the replies, and we’ll help.

We’re working on a page where you’ll be able to check whether your personal information was affected by this incident. We’ll share more details in the coming days.

The 180-day retention period was intended to give us sufficient time to address customer support issues related to their devices and orders. We agree that we failed to adequately verify that our automated deletion tool was working as intended. We relied on the tool without sufficiently checking whether the deletion process had been completed successfully. This was a failure in our internal processes, and we take responsibility for it. We’re tightening our data retention procedures and implementing additional safeguards to ensure that customer data is reliably deleted within the specified retention period going forward.

You're right, and we genuinely fell short here. We should have made sure the tool was working as intended instead of assuming it was. We take full responsibility for that and are sorry we let you down. We'll work to do better.

We understand your concern. To reduce the risk, we've paused shipments and will destroy all 18,835 devices in our inventory that use the old authentication key. None will be sold or shipped. Customers who received devices after October 20 will be advised to contact our support team for guidance on verifying their device's authenticity. New orders will be fulfilled with devices using the new authentication key, with shipping expected to begin within 4–6 weeks.

This concern applies to devices received after October 20, 2026. If someone received their device after this date, we urge them to contact our customer support team for guidance on verifying its authenticity before using it. Please note that we’ve temporarily paused shipments because the devices currently in our inventory use the old authentication key. All 18,835 devices containing the old key will be destroyed and will not be sold or shipped to customers. New orders are now available for preorder, and devices using the new authentication key are expected to ship within 4–6 weeks.

If you receive your device after October 20, please contact our customer support team for guidance on verifying its authenticity. P.S. We’ve temporarily paused shipments of new orders because the devices currently in our inventory use the old authentication key. All 18,835 devices containing the old key will be destroyed and will not be sold or shipped. New orders are now available for preorder, and devices with the new authentication key are expected to ship within 4–6 weeks.

Thanks for raising this important concern. We recommend that anyone with an unopened device contact us at [email protected] for guidance on verifying their device’s hardware authenticity.

Devices received before October 20, 2026, can still be verified as genuine through the device verification process. The risk posed by the leak of the old key is that an attacker could use it to create counterfeit devices that pass verification. However, this risk does not apply to devices obtained before the leak.

Customer wellbeing and security come first. Destroying 18,835 devices is a costly decision, but we believe it’s the right one to protect our users 🙏

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.