Crypto Hardware Wallet Manufacturer Destroys 18,835 Unsold Units After Security Breach

Major Security Breach in Crypto Hardware Wallet Company

A major security breach has led a crypto hardware wallet company to take drastic measures by destroying close to 19,000 unsold products. The incident, which came to light on October 20, 2026, was a result of a hacker exploiting a weakness in a third-party monitoring tool associated with the firm's website. The company reported that the breach allowed the attacker to gain access to sensitive customer data and a critical device authentication key.

Details of the Breach

In total, the breach compromised records for 25,964 customers, revealing personal information such as names, shipping addresses, and order histories spanning from 2024 to 2026. Additionally, data on 12,873 incomplete checkout transactions was also accessed. Fortunately, there was no compromise of recovery phrases, private keys, or any payment details.

The company highlighted that the authenticity key, embedded in their devices at the manufacturing stage and irremovable, poses a significant risk. If misused, it could enable the counterfeit production of wallets that falsely pass authenticity tests, potentially leading to asset theft for unsuspecting users.

The key is crucial for maintaining trust in our authentication system.

The firm stated, underlining the potential dangers of the breach, which could allow counterfeit devices to be sold as legitimate products.

Company's Response

In reaction to this significant security lapse, the company has ceased the use of the compromised key in production. They are permanently destroying the 18,835 devices that are still in stock and have put a halt to all shipping of pending orders. Moving forward, clients will have to pre-order new units that will utilize a new authentication key.

Additionally, the organization has taken steps to minimize future risks by cutting data retention periods from 180 days to 90 days, filing requests for data removal with Shopify, and notifying regulatory bodies across the EU, UK, and beyond about the incident.

Advice for Users

Users of devices shipped prior to the breach date can breathe a sigh of relief, as these devices continue to remain valid provided they pass existing authentication checks. The company is also advising customers to be wary of potential scams that may arise, particularly those offering services such as asset migration or wallet verification.

Stay updated with the latest in finance, covering everything from Bitcoin and Ethereum to web 3.0 and other emerging technologies.