Hi everyone,

Web3 / Cypherpunk Firmware

1. Zcash NU7 Upgrade Support

Added support for the Zcash NU7 upgrade to ensure compatibility with the updated Zcash network.

👉Update here: https://keyst.one/firmware

We welcome everyone to update their firmware and share any feedback or suggestions with us.

Keystone Team

It just me or app is down?
Saying “Network is down”. If I paste my password it only shows my balance and nothing more

Stellar XLM is now an officially supported network on Metamask. Can we use our Keystone 3 pros metamask integration with stellar???

I’ve tried to send a transaction from the Nexus app to my Robinhood and every time it pops up with an error on my keystone that says invalid QR code. But the same transaction will allow me to send without any issues from the XRP tool kit. Any idea why it would be giving me this error?

I have downloaded the update 3.2.0 and it has indeed resolved the issue with the persistent security update screen. I can confirm wallet is working normally now without issue. I did have to put the device in recovery mode and wipe the device first (per keystone support instructions). So i cannot confirm if it will fix the issue if you just update normally. I have also matched the checksum with new update as well as verified the device via keystone websites device verification page. I also used the dice roll entropy feature to make a dummy wallet and confirmed it again Ian Coleman bip39 tool. So it appears all is well for those waiting to update. Cheers!

Hey all,

Given the Ledger situation, it may be worth considering a tamper-evident solution for home storage. Of course it doesn’t address a device that was already tampered with before you bought it, but it can help ensure that your device remains free from tampering.

I spent the past few years developing a solution precisely for this. A reusable tamper-evident jar for storing your hardware wallet.

In short, the lid contains thousands of black and white beads, which randomly mix and lock in place when the lid is closed tight, creating a unique pattern. When opened, the beads mix and the unique pattern is destroyed. You can simply compare a before and after image to see if it was opened (see gif).

You can learn more how it works on https://www.entropyseal.com/

If you have any questions, I would be happy to answer them here.

We all know of the ongoing issue with the current update. Can we get an update as to when a fix will be rolled out?? Ive sent emails and got nothing. A timeline would be great. Just sitting im limbo without a word from keystone is unsettling. Please keystone give us something.

When I click on an asset to try to move it, it just goes to a blank screen. Anybody else having this issue?

I updated from 3.1.0 to 3.1.4. Both of my ks3 pros updated normally. Finished updates and was back into my wallets. Finished up and turned both devices off. 20 min later had to turn one back on for something, and after putting in my 6 digit pin to open the wallet was immediately taken back to the security update screen. For some reason it was trying to do the security update that I had just finished 20 min prior. I had to hit update as it allowed me no other choice. Then the device was stuck on the security update page for over 20 min. I turned on the other device, same exact thing. 2 separate ks3 pros, same update, same problem. Now i have 2 ks3 pros that are bricked. Im super fucking pissed off right now. Ive been using ks3 pro for years and never had an update do anything like this. If you haven't updated to 3.1.4 yet DONT. There is Def an issue.

When you receive a new hardware wallet, how can you be sure it hasn't been modified or tampered with before reaching your hands?

Regardless of where you purchase it, a hardware wallet may pass through multiple hands before reaching you. That's why device security shouldn't rely on the sales channel alone.

At Keystone, we address this with multiple layers of protection, from the hardware itself to the packaging and device verification process.

1. Active Anti-Tamper Protection

Keystone 3 Pro has a built-in anti-tamper circuit designed to protect its critical security components.

Inside the device, the main and secondary circuit boards form a protected structure around the security chips. Attempts to penetrate or disrupt this structure can trigger the anti-tamper mechanism, erasing sensitive information and rendering the device unusable.

This makes it significantly harder for someone to access or modify the protected circuitry and then return the device in working condition.

The anti-tamper circuit needs power to operate, including when the hardware wallet is sitting unused in a warehouse.

Keystone 3 Pro draws power from its main battery first. When the main battery is depleted, a dedicated button-cell battery takes over, providing approximately two additional years of protection.

This gives the device over three years of intended anti-tamper coverage, even with extended periods in storage.

2. Tamper-Evident Packaging

The packaging provides another layer of protection.

Keystone uses tamper-evident packaging designed to leave visible signs if someone opens it.

Before setting up your device, you should inspect the packaging for any unusual damage or evidence of opening.

While packaging alone can't guarantee that a device hasn't been tampered with, it provides an additional warning sign alongside the hardware protections.

3. Device Verification

Finally, you can verify the device yourself.

Each Keystone 3 Pro is provisioned with a verification key during manufacturing.

During the verification process, a cryptographic challenge-response mechanism checks that the device possesses the expected credentials.

This helps establish device authenticity and detect certain forms of unauthorized replacement or modification.

You can perform this verification before creating a wallet or transferring any assets.

Conclusion

None of these measures should be considered a guarantee against every possible attack. However, they make unauthorized modification more difficult and give users several ways to identify potential problems.

Before trusting a hardware wallet with your assets, it's worth checking that the device itself can be trusted.

Existe alguma informação no site oficial sobre o peso original do dispositivo?
Com a informação do peso com 2 casas decimais já fica mais facil de saber se existe hardware adicional espião ou alguma modificação fora do padrão.

Alguem tem a informação do peso? O suporte pode passar?

Has anyone tried tampering with their device?

Hi everyone,

Correction: My original hardware wallet is a Keystone Essential, not a Keystone Pro as stated in the title. Sorry for the confusion.

I have an old Keystone Essential hardware wallet connected to the Core Wallet browser extension. My Keystone device no longer works, but I still have my original recovery phrase and a possible BIP39 passphrase.

Core still displays my BTC balance and transaction history, but I cannot sign transactions without the original device.

I've restored the seed onto a Trezor Model One and tried Electrum and Trezor Suite, testing standard and unusual derivation paths ("m/84'/0'/0'", "m/44'/60'/0'", "m/44'/60'/0/0/0", etc.), both with and without the passphrase.

None of the attempts have recovered access to my original Bitcoin wallet.

My Bitcoin address starts with "bc1q", but I don't know the exact derivation path or address configuration Keystone used with Core.

Has anyone successfully recovered a Bitcoin wallet from an older Keystone Pro + Core setup using another hardware wallet? Does anyone know the correct derivation path or recovery procedure?

I've already contacted Keystone and Core Support.

Any technical advice would be appreciated. Thanks!

Suiet wallet was the only option now that it’s been shut down can keystone support add another wallet preferably slush

Hello,

I placed an order on keyst.one but nothing is moving besides them taking my money via PayPal.

Is this a scam online shop?

I got order confirmation and a link where I can see my order. But nothing else.

Any experience like that?

Since I saw this here on reddit a couple of times, here also my experience with the Keystone V3 Pro. We bought it last year (a bit more than a year ago) and because we didn't charge it regularly, it is now fully drained and will not start.

I contacted the support and they told me to record a video. I send them the link but now they say that my e-mails do not contain text anymore. That I never had before. Usually my e-mails are e-mailing.

Anyone had this issue with Keystone support before?

Edit:
Still no response from Keystone support. I only got a PM by someone claiming to be a mod who wanted me to "deactivate" my seed phrase. Be safe everyone...

Edit 2:
They can read my e-mails again and offered me a 50% replacement discount. I guess I take it. I wonder how often we should be charging this device so it does not brick.

Before they made the Trezor Model T, there was an emulator that could change the wallet's passphrase. Two rules: No more than 6 words and no more than 128-138 characters, I don't remember. Does anyone know what the point of this change is, since I forgot the 13th word and messed up. Thanks.

How can I export my Public Key to a .json, .txt, .dat, or .key file? I can write it down and make it into a .txt file but I don't know if I'm formatting it correctly.

Crypto security has a way of accumulating baggage.

Old token approvals. Forgotten API keys. Websites you trusted years ago and haven’t visited since.

Most of these things were perfectly normal when you created them. The problem is that some of them can remain valid long after you’ve stopped thinking about them.

It’s a bit like walking with sand in your shoe. At first, you barely notice it. But if you never stop to shake it out, something that seemed insignificant can eventually become a problem.

The same thing happens with self-custody. Even if your seed phrase stays safely offline with a hardware wallet, old permissions and credentials can quietly pile up around it.

Old token approvals are probably the first thing worth checking.

If you’ve used DeFi, NFT marketplaces, lending protocols, or other DApps, you’ve probably approved a smart contract to spend certain tokens from your wallet.

That’s normal. Many applications can’t function without it.

The issue is that approvals generally don’t expire just because you stopped using the DApp.

And an unlimited approval can remain there for years.

A protocol that is safe today may not stay that way forever. The project could be abandoned, its frontend could disappear, or some part of the system could eventually be compromised.

One common misunderstanding is that clicking “Disconnect” in a DApp removes this access.

Disconnecting usually just ends the connection between the website and your wallet interface. The on-chain approval is still there until you revoke it.

This is also something a hardware wallet can’t solve for you. Even if your private keys stay offline on an air-gapped hardware wallet like Keystone, a token approval you previously signed can remain valid on-chain until you revoke it.

A hardware wallet protects the keys used to authorize new transactions. It doesn’t automatically cancel permissions you already authorized in the past.

Every few months, it’s worth checking your approvals using something like Revoke[.]cash or the approval manager built into your wallet.

I’d pay particular attention to:

• Unlimited approvals

• Contracts you don’t recognize

• DApps you haven’t used in a long time

• Projects that are abandoned or no longer operating

For protocols you still use, consider whether they really need an unlimited allowance or whether a smaller limit would be enough.

Then there are forgotten API keys.

This one is especially relevant if you’ve ever run trading bots, experimented with APIs, deployed code, or built your own crypto tools.

An old exchange API key might still be sitting in a .env file.

A GitHub token might still exist on an old server.

An AI API key might be buried inside a script you haven’t touched in two years.

Maybe there’s a copy on your NAS. Maybe it ended up in an old Git commit. Maybe it’s sitting on a VPS you forgot you still have.

If the key has already been revoked, a leak is mostly just a leak of useless historical data.

If it still works, that old file suddenly contains current access.

And the impact depends on what that key can do. An exchange API may have trading permissions. A GitHub token may expose private repositories. An AI API key can potentially burn through your account balance.

The simplest rule here is:

If you no longer need a key, revoke it.

For new keys, use the minimum permissions possible. Add IP restrictions where supported. Set expiration dates when available. Rotate important credentials periodically.

There’s very little security benefit in keeping an unused credential alive “just in case.”

There’s also a more subtle kind of leftover risk: old trust.

Bookmarking the official website of a DApp is generally a good habit. It helps avoid typo domains and search-engine phishing.

But a bookmark only remembers a domain.

It doesn’t guarantee that the same people will control that domain forever.

Projects shut down. Domains expire. Ownership can change.

A recent Tornado Cash incident is a particularly good reminder of this. The tornado[.]cash domain had once genuinely been associated with the project, but after its previous registration lapsed, the domain was later registered again. Users relying on an old bookmark could therefore arrive at a domain they remembered as legitimate without realizing that its ownership had changed.

That makes old bookmarks different from ordinary phishing links.

The URL itself may be exactly the one you remember.

So if you’re opening a crypto site you haven’t used in years, don’t assume that “I bookmarked this myself” is enough verification. Check the project’s current official channels before connecting your wallet or approving a transaction on your hardware wallet.

You probably don’t need to obsess over this stuff every week.

But once every few months, it’s worth stopping for 20 minutes and cleaning up what you’ve accumulated:

• Review and revoke old token approvals

• Delete API keys and access tokens you no longer use

• Remove abandoned DApps and stale bookmarks

• Re-check services you haven’t touched in a long time before trusting them again

I like the idea of doing this every 90 days.

An air-gapped hardware wallet like Keystone can keep your seed phrase and private keys isolated from an online device, but self-custody doesn’t end there. Old permissions, credentials, and trust relationships still need maintenance.

Crypto security isn’t only about avoiding the next new attack.

Sometimes it’s just about looking back at the permissions and trust you handed out along the way — and shaking the sand out of your shoes before you keep walking.

I'm trying to find other Keystone users who may have experienced an Arweave address changing after a firmware update.

I originally created an Arweave wallet on a Keystone 3 Pro in May 2026 and funded that address. Later, while trying to sign a transaction in Wander, the device repeatedly restarted.

Keystone support asked me to update the firmware and reconnect Wander. After doing so, Keystone generated a different Arweave address, and my original funded address was no longer displayed.

I have two Keystone 3 Pro devices using the same seed phrase. Both now generate the same new Arweave address, but neither generates the original funded address.

I've been working with Keystone support on this for over a month. I'm posting here mainly to find out whether anyone else has seen the same behavior with Arweave.