Keystone security incident and guidance for BitcoinVN Shop customers

BitcoinVN Shop | 27 October 2026

Keystone has disclosed a security incident affecting its official website and instructed distributors to withhold existing hardware wallet inventory and replace certain recently delivered devices.

As of this morning, sales of Keystone devices at BitcoinVN Shop have been suspended until further notice. Pending orders have been cancelled or placed on hold, and our team is discussing refund arrangements with the affected customers.

For customers who already have a device, the key detail is when you received it.

What happened

Keystone says the attacker obtained a device-authentication key, known as the WebAuth key, alongside customer information. This key is used to check whether a device is genuine. Its exposure could allow counterfeit devices to pass authentication checks.

According to Keystone, the authentication key is not involved in generating recovery phrases, deriving wallet private keys or signing transactions. Its theft therefore does not, by itself, give an attacker access to the funds on an existing genuine device. It does, however, undermine an important check used when accepting a new device.

Based on Keystone’s disclosure, we do not currently anticipate an immediate risk to funds held on genuine devices from the authentication-key compromise itself. Customers should nevertheless follow the guidance below.

BitcoinVN Shop’s response

All Keystone devices imported by BitcoinVN Shop are genuine and, to the best of our knowledge, have not been tampered with. They were manufactured and imported before 20 October 2026. However, this does not change Keystone’s replacement instructions, which depend on when the customer received the device.

As of this morning, our team has contacted all customers who purchased a Keystone device from us over the past week, covering the incident cutoff date. We are working directly with these customers to coordinate replacement devices in line with Keystone’s guidance.

What Keystone customers should do

Devices received before 20 October 2026

Keystone states that devices received before 20 October that pass its on-device verification are genuine and can continue to be used. This assurance is conditional on both the delivery date and successful verification.

Devices received after 20 October 2026

Keystone has instructed distributors to provide a replacement from the new production batch to customers who received their devices after 20 October, including purchases made through normal sales channels.

If you purchased your device from BitcoinVN Shop, fall into this group and have not heard from us, please contact us through your existing order conversation or the contact details on our website. Provide your order reference and the date you received the device so we can review your purchase and coordinate the next steps.

Passing an authenticity check does not remove the replacement instruction for this group. If you have not yet set up the device, wait for guidance before using it.

Devices received on 20 October or with an uncertain delivery date

Please contact us for clarification. Keystone’s distributor notice distinguishes between deliveries before and after 20 October without explicitly addressing deliveries on that date. If you have not yet set up the device, wait for guidance before entering a recovery phrase or adding funds.

Existing stock and replacement devices

Keystone has directed distributors to seal all existing hardware wallet inventory and withhold it from sale. It has committed to replacing that stock one for one. Customer replacements must come from the new production batch, which Keystone says can be verified through its updated official website.

Verify any replacement arrangement independently

A genuine replacement programme can give scammers a convincing pretext to contact wallet owners. Confirm any proposed replacement through a contact channel you already know before using a device or following setup instructions.

Never share your recovery phrase or private keys with support staff, enter them into a website, or send photographs of your backup. Do not use an unexpected replacement device until you have independently confirmed its origin. A message containing your correct name or order details is not proof that the sender is legitimate.

If you have already set up a device covered by the replacement instruction, tell us when you contact us. Keep your recovery backup private and secure, and do not reset or return an initialized device without first establishing a safe recovery and replacement procedure.

For hardware wallets, confidence in the source and authenticity of the device is essential. Please contact BitcoinVN Shop if you need help checking how Keystone’s instructions apply to your purchase.

Source: Keystone’s official security statement and its subsequent instructions to distributors.