Is Keystone safe to connect?
Self-custody wallet ยท Bitcoin, Ethereum, Solana, Other chains via companion wallets (Bitcoin-only firmware also offered). Checked 2026-10-25; every line links its source.
Worst case: Keystone is self-custody, so the device cannot be frozen, but anyone who gets your recovery phrase can empty every wallet it backs up. After the Oct 2026 store breach, scammers holding real names, addresses and order details can send convincing refund or 'replacement device' messages to get your phrase.
Safe setup in 3 steps
- Buy only through keyst.one, typed in yourself or from a bookmark, and never from links in unexpected emails, texts or letters; for anything that looks wrong, contact support@keyst.one (Keystone's post-breach guidance)
- Check firmware against Keystone's verification guides in its GitHub docs before installing an update (KeystoneHQ/Keystone-developer-hub: application and secure-element update package verification)
- Never enter your recovery phrase on a website, in an app or on a device you did not order, and ignore breach, refund or replacement-device messages that ask for it; Keystone says it never asks for recovery phrases or private keys
What it can do with your money
| Who holds the keys | You hold the keys Self-custody, air-gapped hardware wallet: the device has no WiFi, Bluetooth or NFC and signs through QR codes. Bitcoin Magazine says seeds can be generated on the device itself and that the Keystone 3 Pro erases stored keys if it detects physical tampering. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign every transaction on the device yourself; the companion app builds the transaction and broadcasts it once signed. Anyone who has your recovery phrase can do the same from another device. source |
Official links
- Website:
keyst.one - X:
@KeystoneWallet - GitHub:
github.com/KeystoneHQ - App:
https://apps.apple.com/us/app/keystone-nexus/id6742313403 - App:
https://apps.apple.com/app/id1567857965
Where we confirmed these
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-10-24 | Keystone disclosed unauthorized access to its official website (detected Oct 20; it confirmed on Oct 23, after reviewing API activity with Shopify, that a third party took customer shipping information). Exposed: names, contact details, shipping addresses and order details (items and prices). Keystone says payment card or bank details, recovery phrases, private keys and wallet passwords were not exposed (not independently verified). Keystone warned scammers may pose as Keystone by phone, text, email or mail and offer refunds, replacement devices or order/address 'fixes'. | Keystone says it blocked the access, patched the vulnerability, opened an investigation and is emailing affected customers; a detailed report was promised 'in the coming days' and had not appeared as of Oct 25. Number of customers, attack method and the Shopify app or credential involved were not disclosed. No loss of funds was reported. | source |