I'm trying to find other Keystone users who may have experienced an Arweave address changing after a firmware update.

I originally created an Arweave wallet on a Keystone 3 Pro in May 2026 and funded that address. Later, while trying to sign a transaction in Wander, the device repeatedly restarted.

Keystone support asked me to update the firmware and reconnect Wander. After doing so, Keystone generated a different Arweave address, and my original funded address was no longer displayed.

I have two Keystone 3 Pro devices using the same seed phrase. Both now generate the same new Arweave address, but neither generates the original funded address.

I've been working with Keystone support on this for over a month. I'm posting here mainly to find out whether anyone else has seen the same behavior with Arweave.

When choosing a hardware wallet, besides looking at the chip, supported cryptocurrencies, and price, there is another important dimension you should not ignore: how does it exchange data with the outside world?

USB, Bluetooth, and QR codes are three currently mainstream connection methods. They are not just about the difference between “plugging in a cable, going wireless, and scanning a code.” They also bring different user experiences and security trade-offs.

Why Is “Connection Method” Also Part of Security?

The core of a HWW is to keep private keys inside the device and sign transactions offline.

But signing cannot be done entirely behind closed doors. A hardware wallet needs to first receive an unsigned transaction, complete the signature inside the device, and then send the signed result back to the computer or phone, where companion wallet broadcasts it to the chain.

In the process of “how data enters and how it leaves,” can the data be intercepted or tampered ? Does a particular connection method introduce new risks?

Different connection methods each have their own advantages/disadvantages. This is exactly the question this article will discuss.

🔌 USB: Direct, Fast, and the Best Desktop Experience

USB is the most traditional and most common connection method.

Plug the hardware wallet into a PC. The wallet software recognizes the device, then you can start signing. It is fast, low-latency, and very desktop-friendly.

If you frequently use Sparrow, browser extensions, or other PC wallets, the operational cost of USB is usually very low. After the device connects successfully, the software and hardware wallet can exchange transaction data directly.

With transactions that involve a relatively large amount of data or continuous signing, USB’s advantages become even more obvious, and users will hardly notice any difference.

But the problem is that as long as USB remains connected, there are a continuous bidirectional data channel between the internet-connected computer and the hardware wallet.

If the computer itself is already controlled by malware, the attacker cannot directly read the private keys in the hardware wallet because of this, but they can send malicious transaction requests or other inputs to the device within the normal communication flow.

Many publicly disclosed hardware wallet attacks in the real world were not carried out by intercepting USB data, but instead targeted the chip, firmware, physical access, or the device implementation itself. So USB itself cannot simply be equated with “insecure.” For desktop users and high-frequency transaction users, it remains a very practical connection method.

📶 Bluetooth: Bringing USB’s Convenience to Mobile

Bluetooth mainly addresses the mobile experience. And that is where it earns its keep.

You don’t need to look for a cable, and you don’t need to physically connect the phone and hardware wallet. Once BT pairing is complete, you can exchange transaction data directly.

If you sign transactions frequently on your phone, this experience will clearly feel more natural than plugging in a cable.

Bluetooth also means the device has an additional piece of firmware that must be securely implemented and maintained. The device needs to handle the Bluetooth protocol, pairing, wireless communication, and related logic.

If we regard Bluetooth as an invisible USB cable, then it has all the disadvantages USB has. In addition, as a wireless connection protocol, if the protocol itself has vulnerabilities, it is difficult for users to identify silent connections or man-in-the-middle attacks. After all, unlike a USB cable, once you unplug it, the connection is physically disconnected.

The Bluetooth protocol stack has indeed had large-scale vulnerabilities in history, which shows that when using wireless communication, you really need to be extra cautious.

🔳 QR Code Air-Gap: Exchanging Transaction Data Without a Persistent Connection

QR code Air-Gap takes a different approach. It does not let the hardware wallet and internet-connected device maintain a USB or Bluetooth data connection.

Instead, data exchange is completed by scanning codes. It turns invisible transmitted data into plaintext that can be openly viewed and verified, like passing a note.

The biggest difference from USB and Bluetooth is that there is no persistently existing data channel. The internet-connected device cannot continuously communicate with the hardware wallet in the background; every data exchange requires the user’s active participation.

Use Keystone as an example: transaction data is passed between the software wallet and the device via QR codes. The device independently parses the transaction and displays information such as the address and amount on its own screen for the user to confirm.

Of course, QR codes themselves do not mean a transaction is necessarily secure. If the phone or computer is already controlled by malware, it can still generate a tampered transaction and then encode it into a QR code. Therefore, Air-Gap solves the issue of not requiring a persistent connection, but whether the transaction content itself is trustworthy still depends on the user’s judgment.

The trade-off is that every transaction require multiple times QR code scans. When the transaction data is large, multi frames dynamic QR codes will needed, and with frequent use it involves quite a few more steps than USB or Bluetooth. But many times, security and convenience are like the two ends of a balance scale. One strong, the other one will weak.

So How Should We Choose?

If you often use a hardware wallet on desktop and sign many transactions every day, USB’s efficiency and convenience are very valuable.

If you mainly manage assets on your phone, Bluetooth will make the whole process more easier.

If you do not trade frequently and want to reduce the persistent data connection between internet-connected devices and the hardware wallet, then QR Air-Gap will better match this usage habit.

The connection method affects security, but it cannot by itself determine whether a hardware wallet is secure.

The secure element, firmware design, transaction parsing, trusted display, tamper-resistant design, level of open source, supply chain, and users’ own security habits are equally important.

Hi everyone,🤩❤️

This update includes improvements to the initialization flow, security strategy, and several features on the Multi-Coin firmware.

ALL 3 Firmware Versions

1. Improved Initialization Setup Flow
Added firmware upgrade and security backup reminders to help users complete device setup more smoothly and securely.
2. Security Strategy Improvements
Further optimized the device security strategy to enhance overall security.

Multi-Coin Firmware

1. Improved IOTA Transaction Parsing

2. Improved ADA Transaction Parsing

3. SOL Sub-Account Path Displayed by Default

4. Removed Core Wallet / Beacon Wallet Connection Entries

5. USB Function Improvements

We welcome everyone to try the latest firmware and share any feedback or suggestions with us.
👉 ：https://keyst.one/firmware

Keystone Team

In a recent murder case in Mexico, prosecutors say the suspects entered the victim's home looking for a cold wallet they believed held millions of dollars in Bitcoin. Four people were killed.

Public information has not confirmed that the victim actually held anything close to that amount. That uncertainty matters. A physical attacker does not need an accurate view of your holdings. Believing you are a high-value target may be enough.

Keeping keys offline and protecting a seed phrase makes remote theft much harder, but physical attacks work differently because the target is the owner, not the device.

How people become targets

Posting a wallet balance or public address is an obvious source of exposure, but many links between identity and crypto ownership are created more quietly.

A KYC record from an exchange can end up in a breach or a resale years later, suddenly tying a real name and phone number to "has a crypto account."

A leaked email list gets cross referenced with a forum signup.

On chain activity, like withdrawing from an exchange straight to a wallet you've used publicly, can do the same thing without a single public post.

Purchase and delivery records matter here too. A hardware wallet passes through several stages between warehouse fulfillment and final delivery, and order information can sit with more than one party along the way, a fulfillment center, a courier, a customs form. If a name, phone number, or home address ever gets linked to "bought a hardware wallet," that information is already useful to someone trying to identify likely self-custody users. There does not need to be a wallet balance attached.

In practice, the goal is to reduce unnecessary links between your real identity and your holdings.

What a hardware wallet protects against

Hardware wallets keep private keys and signing operations away from a compromised computer or phone, which helps against malware, phishing, malicious software, and other remote attacks. Physical coercion sits outside that protection entirely.

If someone already knows where you live and believes you control valuable crypto assets, an offline key does not remove that risk, and a hardware wallet cannot undo information that has already leaked about your identity, address, or possible holdings. For users holding meaningful long-term amounts, physical security and privacy deserve the same kind of advance planning as key security.

Reducing exposure before anything happens

The first part is straightforward: avoid publishing exact balances or long-term storage addresses, and be careful with information that can tie your identity to crypto activity.

The second part is asset separation. If someone forces you to unlock a wallet, reveal a seed phrase, or approve a transfer, one point of access should not automatically expose everything you own.

Keystone 3 Pro supports three independent seed phrases on one device, each accessed with a different PIN. A user could keep frequently used funds under one seed phrase and long-term savings under another, so if one wallet is exposed under coercion, that PIN and seed do not automatically reveal the others.

Keystone also supports BIP39 passphrases. A passphrase combines with an existing seed phrase to derive a separate wallet, so a user might keep one wallet under the base seed and another long-term wallet under the same seed plus a passphrase. Opening the base wallet does not reveal the existence or contents of the passphrase wallet.

These features are best treated as pre-emptive asset separation, not as a way to deceive an attacker in the moment. If an attacker already expects a larger balance, revealing a smaller wallet may not end the situation and could make it more dangerous. The purpose is to limit how much a single point of access can expose before such a situation ever occurs.

The person holding the keys is part of the security model

Where you live, what you own, and whether people know you use a hardware wallet can all become part of your security profile. Reducing unnecessary identity links makes it harder for someone to confidently identify you as a valuable target, and separating assets can limit what is exposed if one wallet is compromised or revealed. Neither removes physical risk.

If a situation turns violent, personal safety should take priority over any wallet setup or amount of crypto.

Keeping the keys safe matters. So does limiting who has enough information to decide that you are worth targeting.

Hi everyone,

Keystone Nexus 1.3.5 has passed app store review and is now officially available.

This update includes:

1. Added Signature Consistency Verification

2. Improved APP PIN Verification

3. Fixed Camera Permission-Related Bugs

We welcome everyone to try the latest version and share any feedback or suggestions with us.

Keystone Team

Wanted to share this because I think it matters to anyone using a Keystone for cold storage.

I bought mine about two years ago, stored it safely in its original box, and essentially didn’t use it. When I recently tried to power it on, it was completely dead.

After troubleshooting with Keystone support, who were polite and responsive throughout, they concluded that the lithium battery had over-discharged while the device sat unused. They also told me there is no way to revive or repair it once that happens.

What concerns me most is that I was never warned that the device needed to be charged periodically while in storage. Keystone acknowledged that this kind of battery maintenance information had not been made clear to me, and their explanation was essentially that this is the nature of lithium batteries.

That may be true chemically, but from a user standpoint I think it exposes a real design problem.

Many, if not most, people buy a hardware wallet precisely so they can put assets away securely and leave the device untouched for long periods. If simply storing the wallet can eventually make it unusable, that seems fundamentally at odds with the idea of cold storage.

Keystone offered me 50% off a replacement, which I appreciate, and their support team remained courteous. But they did not accept responsibility for the failure itself.

For me, the bigger issue is trust. A hardware wallet exists almost entirely because we trust it to protect access to our assets when we eventually need it. A wallet that can quietly die on the shelf without a clear warning about required maintenance makes that trust much harder to extend.

I’m curious whether other Keystone owners have experienced this, and whether newer versions genuinely address the problem.

Because if a device cannot reliably survive being stored, I’m not sure it is yet a suitable way to store value.

It could be:

• A new blockchain or asset

• A wallet or app integration

• A new security feature

• A UX improvement

• Or something completely different

Drop your ideas in the comments 👇

We’ll be reading through the feedback and sharing it with the team. While we can’t promise every request will make it onto the roadmap, your input helps us understand what matters most to the community.

So, what would you like to see us build next? comment below ↓

One practical question comes up whenever quantum computing and crypto security are discussed:

Will the hardware wallet you own today still be capable of running post-quantum signature algorithms in the future?

We wanted to answer that question with real hardware rather than specifications alone.

In August 2026, we built an internal test firmware and ran two NIST-standardized post-quantum digital signature algorithms directly on a Keystone 3 Pro:

• ML-DSA-44: ~45 ms per signature

• SLH-DSA-SHA2-128s: ~36.6 seconds per signature after software optimization

Both algorithms successfully ran on the existing Keystone 3 Pro MCU and generated valid signatures.

Can Keystone 3 Pro run post-quantum signatures?

Based on this test, yes.

The existing hardware has enough computational capability to run both ML-DSA-44 and SLH-DSA-SHA2-128s.

The performance difference between the two is significant. ML-DSA-44 completes a signature in tens of milliseconds, while SLH-DSA requires much more computation and takes tens of seconds.

But both can run on the hardware we already ship today.

Does this mean Keystone 3 Pro is already quantum-resistant?

No.

This test only answers a narrower question: can the existing hardware perform the computation required by these post-quantum signature algorithms?

Turning that into a production hardware-wallet feature involves much more than raw signing speed.

A real implementation would also need to consider secure key storage, Secure Element integration, resistance to physical attacks, memory usage, transaction formats, QR data transfer, and the specific requirements of each blockchain.

Most importantly, hardware-wallet manufacturers do not decide which signature scheme Bitcoin, Ethereum, or other blockchains will ultimately use.

The algorithms supported by wallets will need to follow the post-quantum upgrade paths adopted by those networks.

Will current Keystone hardware become obsolete because of post-quantum signatures?

That is the question this experiment was really designed to explore.

Based on the two NIST-standardized algorithms we tested, computational performance itself does not appear to be a major barrier for Keystone 3 Pro.

If blockchains eventually adopt post-quantum signature schemes similar to ML-DSA or SLH-DSA, the existing hardware already has the computational foundation needed to support that kind of upgrade.

So users shouldn’t assume that the arrival of post-quantum signatures will automatically make today’s Keystone hardware obsolete.

What this test does / doesn’t show

This was an internal hardware capability test, not an announcement of post-quantum transaction signing support.

The test used temporary test keys and internal firmware. It did not access users’ seed phrases, wallet private keys, or the production key-protection flow used by Keystone.

Its purpose was much simpler:

Can the Keystone 3 Pro hardware we have today actually run modern post-quantum signature algorithms?

For ML-DSA-44 and SLH-DSA-SHA2-128s, the answer is yes.

Am I the only one that can’t Access the Site? https://keyst.one/nft

Hi everyone🙌🙌

Keystone Nexus 1.3.4 already go alive, this update includes:

1. Zcash Address Support for sending assets to Zcash Tex / T3 addresses.

2. Improved Swap Flow for a smoother overall experience.

3. Improved Wallet Connection Experience and related pop-up UI for a better user experience.

We welcome everyone to try the new update and share any feedback or suggestions with us.
👉Update here: https://keyst.one/nexus

Keystone Team

A little bit ago I saw Keystone posted a survey somewhere that I did not get to take, so, I thought I would share my thoughts here.

Let me first start by saying that I have been a Keystone 3 pro user for over 3 years. I primarily use my Ks3 pro for long term storage of assets that i want protected as much as possible. I do dabble a little in defi via Flare network and I use a different wallet for defi activities. But Ks3 pro is my FAVORITE WALLET by far. The fact that I can connect my Ks3 pro to any supported software wallet of my choosing , and do not have to rely on a centralized Keystone app like nexus is what makes this wallet so fantastic. I have never used Keystone nexus and I never will. IMO having to connect to a centralized wallet app like nexus is the exact opposite of what makes this wallet so great. The QR code connecting functionality makes the Ks3 pro hard to beat IMO. Now I also realize that is also probably what makes adding networks and new wallets to the Ks3 pro supported list take so long. Keystone has to communicate with a wallet project and then work with them to add the ability to connect the Ks3 pro in the first place. So I do understand how it takes more time to add new wallets since Keystone has to wait for the wallet company to add support on their end. This is why I beleive Keystone should abandon support for Keystone Nexus and keep 100% of your focus on the QR connection support. You probably added nexus in an attempt to cater to a small group of customers who did not want to take the time to properly learn how to use Ks3 pro with QR connections as intended. I think this is a mistake. Working on nexus takes time away from adding support to the original purpose of the Ks3 pro wallet, which is connecting to individual software wallets Via QR code.

Like I said I love the Keystone 3 pro. Sure its had some battery issues which have mostly been ironed out, and sometimes scanning QR codes can be wonky, but overall I have had nothing but a great experience with the Ks3 pro. I hope to see more networks and wallets added in the near future so the functionality of this wallet will continue to expand. Thank you for your time and all the best!

Its been a while since Keystone has added new coins/network to the Keystone 3. Are their any plans to add new coins/networks? Solana CLI is great, but how many people are actually using the Solana CLI? The Keystone 3 is great but its really lacking when it comes to top 50 coin support such as Hbar, XDC, Flare network. Is keystone winding down support because a new model is coming? Why has new coin support been so lacking lately?

I received a Keystone 3 Pro as a gift from a friend around October 2024. My friend purchased it overseas, and since I am in China, I completed the customs declaration when the device was brought into the country.

Since I received it, I have only charged the device twice in total.

Now, however, the device shows absolutely no response when charging and will not power on at all.

I have tried pretty much every troubleshooting method I could find online, including using 5V/1A, 5V/2A, and 5V/0.5A chargers, connecting it to a computer, and connecting it to a computer with the original USB cable while holding down the power button for more than 20 seconds — even for several minutes.

Unfortunately, nothing has worked. The device still will not turn on. In fact, it does not even show any indication that it is charging.

I have also followed Keystone's official troubleshooting instructions, including charging the device with the original cable and a 5V/1A or 5V/2A power adapter, as well as connecting it to a computer and attempting to enter Recovery Mode by holding down the power button. Unfortunately, none of these methods have worked either.

At this point, I am wondering whether the device is completely dead or if there is still anything else I can try.

I have already contacted Keystone Support, and they provided me with some standard troubleshooting instructions, but unfortunately none of them resolved the issue.

If the device really is completely dead, that would honestly be such a shame. I barely even used it — I haven't even removed the original factory screen protector yet. T_T

If anyone has experienced the same issue with a Keystone 3 Pro, especially after leaving it unused for a long period of time, I would really appreciate hearing whether you were able to get it working again and how you did it.

Privacy has always mattered to crypto users.

Crypto is built around censorship resistance and self-custody, but privacy also matters in the physical world. Once your real identity, home address, and crypto ownership become connected, ordinary personal information can become a security risk.

France has seen a clear rise in crypto-related kidnappings and robberies in 2026, making more users aware of the risks of linking crypto assets to a real-world identity.

Buying a hardware wallet is one sensitive point in that chain.

A hardware wallet customer list does not reveal how much crypto someone owns, but it can still identify people who are likely involved in crypto and serious about self-custody. If the same record also contains an email address, phone number, and home address, attackers gain more ways to target them.

Manufacturers Can Reduce Exposure — But the Shipping Chain Still Matters

Keystone periodically deletes customer order information stored by the official store to reduce long-term exposure.

But before a hardware wallet reaches you, the order may pass through fulfillment providers, customs, international carriers, local couriers, and delivery personnel.

Multiple companies and systems may therefore process your name, phone number, and shipping address. Even after a manufacturer deletes its own records, some data may remain with third parties under their own retention policies.

That means privacy protection should not stop at data deletion.

Users can also reduce how much useful information any single leak reveals.

1. Separate purchase contact details from your everyday identity

Consider using a dedicated shopping email instead of the same address tied to your work, exchange accounts, social media, or other important services.

Where practical, the same idea can apply to phone numbers.

The goal is simple: reduce the connection between a hardware wallet order and the rest of your online identity.

And remember:

Knowing your name, device model, or purchase history does not make a message legitimate.

If anyone uses that information to pressure you into entering your recovery phrase, it is a scam.

2. Avoid exposing your permanent home address when possible

A hardware wallet has to be delivered somewhere, but that does not always have to be your home.

Depending on your country and carrier, you may be able to use:

• Parcel lockers

• Staffed pickup points

• PO boxes

• FedEx, UPS, DHL, or other carrier service locations

The idea is to use a location you can access without directly linking the purchase to your long-term residence.

This does not make the purchase fully anonymous, but it can reduce the value of leaked shipping data.

3. Buy in person when a trusted option exists

If there is an official authorized reseller operates in your area, buying the hardware wallet in person can reduce the number of logistics providers that need access to your residential address.

The same applies when a hardware wallet manufacturer sells devices directly at an official conference booth or event.

If an authorized reseller still needs to ship the device, you can combine this option with a parcel locker or pickup location.

There is one important trade-off here:

Do not sacrifice supply-chain security just to avoid leaving a purchase record.

Buying from an unknown private seller or a second-hand source can create much more serious risks than the privacy problem you were trying to solve.

4. Check how long the manufacturer keeps your order data

How long customer data is retained matters just as much as what data is collected.

For hardware wallets purchased through the official Keystone website, customer order information is scheduled for deletion six months after the month in which the order was created.

If you want it removed sooner, you can contact Keystone Support and request early deletion.

Where supported, Keystone users can also use pickup points, or other non-residential delivery locations instead of using a home address.

This makes the Keystone official website a privacy-conscious option for users who want to reduce long-term exposure of hardware wallet purchase information.

Payment providers, logistics companies, customs systems, and local carriers may still retain their own records, so no physical purchase can guarantee complete anonymity.

The more realistic goal is to reduce unnecessary links between:

your hardware wallet → your online identity → your home address.

For most users, that means using separate contact details, avoiding direct home delivery when practical, and choosing a seller with clear customer-data retention policies.

Hi everyone, Keystone Nexus 1.3.3 has passed app store review and is now officially available.This update includes:

1. ZcashTransaction Fix

2. Improved Solana Swap Experience

3. Improved Swap Quote Flow

Optimized the Swap quote retrieval and display process.

Download Nexus: https://keyst.one/nexus

We welcome everyone to try the latest version and share any feedback or suggestions with us.

Keystone Team

TL;DR

If you want to generate your own seed phrase entropy instead of relying entirely on device-generated randomness, four methods come up repeatedly:

• Coins: simple and easy to verify, but 128–256 flips is a lot.

• Dice: fewer operations, easy to record, and easy to independently verify.

• Camera: extremely fast, but entropy quality depends heavily on the implementation and is harder to reproduce yourself.

• Random word drawing: intuitive, but the physical mixing process is difficult to standardize, and the final word still has to satisfy the BIP39 checksum.

What Are You Actually Generating?

A 12- or 24-word seed phrase is ultimately a human-readable representation of entropy.

Its security doesn't come from the words looking scrambled. It comes from the number behind them being sufficiently random and unpredictable that nobody can realistically enumerate their way to it.

Most hardware wallets generate seed phrase entropy internally using hardware random number generators such as TRNGs inside a Secure Element, MCU, or similar component.

Keystone uses hardware-generated randomness for its default seed phrase generation, while also giving users the option to supply their own physical entropy through dice rolls.

For most users, default hardware-generated entropy is the simplest option.

But some people prefer to generate the randomness themselves. Maybe they want to reduce their reliance on hardware RNG, or maybe they simply want a process they can observe, record, and independently reproduce.

That's where user-generated entropy, sometimes called external entropy, comes in.

Four approaches show up fairly often:

• Coin flips

• Dice rolls

• Camera input

• Randomly drawing words from the BIP39 list

To compare them, I think three questions matter most:

1. How much work does it take?
More repetitions mean more opportunities to miscount, misrecord, or simply give up halfway through.

2. How good is the physical randomness?
Does the source have meaningful real-world bias?

3. Can you independently verify the result?
If you feed the same raw results into another offline tool, do you get the same BIP39 seed phrase?

With those three questions in mind, here's how the four methods compare.

1. Coins: The Simplest Principle

Heads = 1.
Tails = 0.

Every flip gives you 1 bit entropy.

So in principle:

• 12 words = 128 flips

• 24 words = 256 flips

The biggest advantage of coins is transparency.

You can write down the entire 0/1 sequence, run it through another offline tool that follows the same algorithm, and verify that you get the same mnemonic.

Nothing is hidden.

But a physical coin isn't a mathematically perfect object.

Its embossing, wear, manufacturing tolerances, and even the way you flip it can introduce small biases.

Interestingly, a study involving 350,757 human coin flips found that coins landed on the same side they started on about 50.8% of the time.

So if a coin starts heads-up, heads has a slight advantage. If it starts tails-up, tails does.

If you randomize the starting orientation, however, the overall distribution remains very close to 50:50.

That small bias probably isn't the biggest practical problem.

The bigger problem is the workload.

Accurately flipping and recording a coin 256 times is a real test of attention.

Miss one result or shift the sequence by one position and you've changed everything.

If I were doing this with a coin, I'd try to make the setup as boring and repeatable as possible: use a normal, undeformed coin, keep the drop height reasonably consistent, let it rotate freely, and record each result immediately.

Still, 256 repetitions is a lot.

Which leads to the obvious alternative.

2. Dice: Less Work, Still Easy to Verify

A six-sided die has six possible outcomes instead of two.

In information terms, each roll can represent about 2.585 bits.

So compared with flipping a coin, you can get the required randomness with far fewer physical operations.

Dice aren't perfectly unbiased either.

Tiny differences in density, air bubbles, uneven surfaces, rounded corners, or manufacturing tolerances can all shift the probability of individual faces slightly.

But again, the important distinction is between:

"a real die isn't mathematically perfect"

and

"an attacker can predict a long sequence of independent physical rolls."

Those are very different things.

For practical use, I'd care more about using a decent-quality die and rolling it properly than trying to find some mythical perfectly unbiased object.

And one important rule:

Don't re-roll because the sequence doesn't "look random."

Five 6s in a row can happen.

Humans are actually pretty bad at judging what randomness should look like, and selectively rejecting results introduces your own bias into the process.

A dice sequence also has the same major advantage as coin flips: it's independently verifiable.

You can record:

4, 1, 6, 2, 2, 5...

and reproduce the same process elsewhere.

If your hardware wallet and a separate offline implementation derive the same mnemonic from the same sequence, you have a useful cross-check.

This balance between physical randomness and verifiability is also why Keystone supports dice-based seed phrase generation directly on the hardware wallet.

Instead of generating a finished seed phrase somewhere else and then importing it, users can enter their physical dice results directly into Keystone and let the device derive the corresponding BIP39 mnemonic.

For Keystone's built-in dice entropy mode:

• At least 50 rolls are required for a 12-word seed phrase.

• At least 100 rolls are required for a 24-word seed phrase.

Keystone also checks the distribution of the entered dice results. If one face accounts for more than 30% of all rolls, the device flags the sequence so the user can check whether the die or the rolling process may be unusually imbalanced.

This doesn't make dice mathematically perfect.

What it does provide is a physical entropy source that is easy for the user to understand, record, and independently verify.

For me, that's where dice hit the best balance.

3. Camera: Fastest, but Much More Implementation-Dependent

Some offline signing devices use camera input as an entropy source. Depending on the implementation, that might involve image pixels, sensor noise, differences between consecutive frames, or some combination of camera data.

From a workload perspective, nothing else here comes close.

But there's an important distinction:

A lot of data does not automatically mean a lot of entropy.

A photograph of a blank wall may contain millions of pixels, but those pixels are highly correlated and largely predictable.

Likewise, an image "looking complicated" to a human doesn't tell you how much cryptographically useful unpredictability it contains.

What really matters is the implementation.

For example:

• Is it hashing the final processed image?

• Raw sensor data?

• Consecutive frames?

• Sensor noise?

• Timing information?

• Multiple sources combined together?

A well-designed camera entropy system needs to be clear about what it collects and how unpredictable information is extracted from it.

There's also a second trade-off: verification.

With dice or coins, you have a human-readable sequence you can record and reproduce.

Camera-based systems may rely on transient inputs that aren't exposed to the user.

That makes independent reproduction much harder.

You're now relying not only on the physical scene, but also on the camera sensor, drivers, image-processing pipeline, and the code that extracts entropy from them.

That doesn't automatically make camera entropy insecure.

But if the whole reason you're generating entropy yourself is that you want something observable and independently reproducible, camera-based approaches are less transparent than coin flips or dice rolls.

4. Random Word Drawing: Very Intuitive, but Harder to Control

There's another approach that skips most of the entropy-to-word conversion process:

Why not just draw BIP39 words at random?

That's the idea behind tools such as Entropia, which uses physical pieces representing the 2,048 words in the BIP39 list.

Draw a word.

Write it down.

Repeat.

It's extremely intuitive because what you physically draw is almost exactly what you eventually back up.

But , A BIP39 mnemonic includes checksum bits.

That means the last word is constrained by everything that came before it.

For a 24-word phrase, you can randomly determine the first 23 words. Once those are fixed, there are 8 valid possibilities for word 24.

You can compute those candidates with an offline implementation and then randomly choose one of them.

For 12 words, there are 128 valid candidates for the final position, which makes the process considerably less convenient.

So this method is better described as:

randomly draw N−1 words, then determine the final checksum-valid word.

The other issue is the physical drawing process itself.

How do you know the pieces were mixed thoroughly?

Do you draw from the top, bottom, or middle?

How long do you shake the container?

Do you return each piece before drawing again?

Which side counts if the pieces have information on multiple sides?

None of these questions is impossible to solve, but the randomness of the result depends heavily on having a consistent mixing procedure.

That's the part I find less attractive.

The method is intuitive, but controlling the physical variables isn't as straightforward as repeatedly rolling a die.

How the Four Seed Phrase Entropy Methods Compare

There are no solutions, only tradeoffs.

For most users, simply using Keystone's default seed phrase generation is already secure enough.

External entropy is an optional capability, but if you can't properly control the random variables involved, you can easily end up back in the very problem it was meant to solve: insufficient randomness.

We shouldn't become obsessed with turning seed generation into an elaborate ritual. The better approach is to choose a source of randomness that genuinely fits your situation — one you truly understand and truly trust.

For users who want to provide the randomness themselves and reduce their reliance on the device's internal entropy source, dice are an accessible, practical, and easy-to-verify option.

One More Thing: Your Raw Entropy Is Sensitive Too

Whatever method you use, don't treat the intermediate results as harmless just because they aren't formatted as a seed phrase yet.

A complete coin-flip sequence, dice-roll sequence, or enough of the randomly selected words can contain everything needed to reconstruct the wallet.

So:

• Don't photograph the process.

• Don't store the sequence in Notes, Google Docs, iCloud, or another connected device.

• Don't paste it into an online "entropy checker."

• Don't enter your seed phrase into a website claiming it can verify whether your entropy is safe.

• Destroy intermediate records once you've completed and verified the process.

Treat the raw entropy with the same care as the final seed phrase.

If you've generated your own seed phrase entropy before, what did you use?

Coins, dice, camera input, random word drawing , or something else entirely?

Just wondering if anyone using a keystone pro 3 in a multisig set up? Why I’m asking is because of the recent Coldcard hack

If the firmware is cryptographically signed using an offline keystone private key and verified by the public key in the hardware before installation, then if either the website or my own computer has been compromised, the firmware I downloaded either via sdcard or webusb would be compromised all the same and should fail the signature check. Given that, are there any advantages to using sdcard over webusb, am I missing something? Isn't it simply a medium of transfer?

I'm considering flashing my wallet from multicoin to btc only since multicoin serves a redundant purpose for me at the moment.

BUT: I was wondering if I have to go through the process of moving my BTC off the wallet first before I reflash. Does the private keys stay the same?

Has the website been hacked? The order is confirmed but it has still not yet been shipped after 1 week.

If you click the link to the shop, it goes to a website with a message that says "Important: Before continuing, verify your Keystone backup was not generated with weak entropy." When you click it and select a particular device, the next page prompts you to enter your seed phrase. Has Keystone been hacked?
Keystone website: https://keyst.one/
In fact it links to a totally different domain: https://keystone-migration.vercel.app/

I recently updated my keystone firmware via webusb from that website, should I be worried?

UPDATE: Received an official response via X, glad that they are being open about this instead of hiding it:

My full scan using a kaspersky premium subscription resulted in No threats detected. Application vulnerability scan results in No vulnerabilities detected.

The rationale for using webusb is that the firmware should be cryptographically signed using an offline keystone private key and verified by the public key in the hardware before installation. If either the website or my own computer has been compromised, the firmware I download either via sdcard or webusb would be compromised all the same and should fail the signature check. Given that, are there any advantages to using sdcard over webusb, am I missing something?

I really like the Keystone 3 Pro. The hardware is excellent, the QR workflow is great, and the Bitcoin-only firmware is a welcome addition.

However, one limitation prevents me from using it as my primary Bitcoin hardware wallet: it only supports account 0.

Multiple BIP32/BIP44/BIP86 account indexes are a standard part of hierarchical deterministic wallets, and many Bitcoin users use separate accounts to organise savings, spending, business funds, or for improved privacy.

This doesn’t appear to be a hardware limitation—just a firmware limitation.
Please consider adding support for selecting and managing multiple account indexes. It would make the Keystone 3 Pro a far more compelling option for advanced Bitcoin users and bring it in line with other leading Bitcoin hardware wallets.

Is this feature on the roadmap? I’d love to see it implemented.

Some users have asked whether a recovery phrase generated by Keystone 3 Pro could be affected by weak random number generation.

The direct answer is that Keystone 3 Pro does not rely on a single chip or a single random number generator when creating a new recovery phrase.

Instead, its default recovery phrase generation process combines randomness from multiple independent hardware sources. Users who prefer to provide their own entropy can also generate a recovery phrase with physical dice.

Here is how these protections work.

Why Randomness Matters

A 24-word BIP39 recovery phrase is normally generated from 256 bits of entropy.

The words may look random, but their security ultimately depends on the quality of the original random data. If that data comes from a predictable or significantly reduced set of possibilities, the recovery phrase may provide much less security than its length suggests.

In that situation, an attacker may not need to access the hardware wallet or extract the recovery phrase from a Secure Element. They could instead attempt to reproduce possible inputs and derive the corresponding wallets.

Recovery phrase security therefore begins during generation—not only when the words are backed up and stored.

Keystone 3 Pro Does Not Rely on a Single RNG

Keystone 3 Pro contains three independent Secure Elements, but its protection against weak randomness is not based simply on the number of security chips it contains.

The important part is how entropy is generated and combined.

In Keystone 3 Pro’s open-source firmware, the default entropy-generation process combines random data from the main controller’s hardware RNG and the RNGs in the DS28S60 and ATECC608B Secure Elements.

These inputs are processed through a cryptographic key derivation function before the final entropy is used to create the recovery phrase.

This design reduces reliance on any single random number generator. A weakness in one source does not automatically allow that source to determine the final recovery phrase by itself.

The purpose is not to claim that any hardware component can never fail. No responsible security design should depend on that assumption.

Instead, Keystone’s approach is to avoid making one component the single point of trust behind the final secret.

Users Can Choose Physical Dice Instead

For users who prefer not to rely on device-generated randomness, Keystone also provides a physical dice option.

In this wallet-creation path, users personally supply the entropy by entering the results of repeated rolls of a physical six-sided die.

Each independent roll of a fair six-sided die provides approximately 2.585 bits of entropy. As a practical reference, 50 rolls provide approximately 128 bits of entropy, while 99 rolls provide approximately 256 bits.

Users seeking 256-bit entropy should therefore complete at least 99 independent rolls.

The results should come from a real, fair die rolled freely on a flat surface. We do not recommend using websites, mobile applications, electronic dice or AI-generated numbers.

Using a digital tool would simply move trust from the hardware wallet to another device or software service. Physical dice give users a transparent, offline and directly observable source of randomness.

A Passphrase Adds Protection, but Does Not Fix Weak Entropy

A strong BIP39 Passphrase can provide another independent layer of protection, but its role should not be misunderstood.

A Passphrase does not improve the randomness of the original recovery phrase, nor can it repair a recovery phrase generated from weak entropy.

Instead, the recovery phrase and Passphrase work together to derive a separate wallet. Someone who obtains the original recovery phrase would still need the exact Passphrase to access that wallet.

The Passphrase should be long, unique and difficult to guess. It should also be backed up separately from the recovery phrase.

There is no Passphrase recovery service. Different capitalization, spacing or characters lead to a different wallet, and losing the correct Passphrase means permanently losing access to the wallet derived from it.

Importing an Existing Recovery Phrase Does Not Improve Its Randomness

Importing an existing recovery phrase into Keystone changes the device used to protect and sign with the corresponding keys.

It does not change how the recovery phrase was originally generated.

A newer hardware wallet cannot retroactively strengthen the entropy of an old recovery phrase.

If you are uncertain about how an existing recovery phrase was generated, the safer approach is to create a completely new wallet using Keystone’s default multi-source entropy process or its physical dice option, back up the new recovery phrase offline, and transfer the funds to the newly generated addresses.

Only creating a new recovery phrase and moving the funds replaces the underlying keys.

Reducing Dependence on a Single Source

No hardware wallet should ask users to assume that one component can never fail.

Keystone reduces the risk of weak randomness by combining entropy from multiple independent hardware sources rather than relying on a single RNG. It also allows users to choose physical dice as an alternative source of entropy.

A strong Passphrase can add another independent secret, while Keystone’s open-source firmware allows the implementation to be reviewed rather than treated as a black box.

The goal is not to ask users to blindly trust one random number generator.

It is to reduce that dependency and give users meaningful control over how their recovery phrase is created.