# Hackers stole authentication keys for @KeystoneWallet devices

Source: https://x.com/MagicalTux/status/2114867064611672370
Kiwi News: https://news.kiwistand.com/stories/Hackers-stole-authentication-keys-for-KeystoneWallet-devices?index=0x6ae0515affdcd63c6c60e86fccd3ff455431a4764688eb65f69d62706683cf47b73a042d
Submitted by misha on 2026-10-27 UTC, 2 upvotes, 0 comments

## Summary

The article is a short social media post, not a news report, and its central point is a question rather than a reported event. The poster notes that hackers reportedly stole authentication keys for Keystone Wallet devices and asks how private keys could have been exposed if each device generates its key inside its secure element during factory self-test. The poster argues that if keys do exist outside the device during manufacturing, that needs urgent improvement, and suggests the device should generate its key and report only the public key.

## Article

Hackers managed to steal authentication keys for devices made by @KeystoneWallet 
I don't understand one thing here however. During manufacturing, as part of the factory self test in initial boot you have the device generate & save a private key on its own, and take note of the public key.
If you have private keys to be stolen, it means that *somehow* a copy of the key exists outside of the secure element on the device?
If the manufacturing process involves each device's private key existing outside of the device, there's something that needs urgent improvement. Have the device generate the key and include its own public key as part of its self test report, not the other way around.
https://x.com/tayvano_/status/2114751291272712626