# Is Keystone safe? Check before you connect

> Keystone: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-25.

Canonical: https://tradingagentstack.com/check/keystone/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Keystone

# Is Keystone safe to connect?

Self-custody wallet · Bitcoin, Ethereum, Solana, Other chains via companion wallets (Bitcoin-only firmware also offered). Checked 2026-10-25; every line links its source.

**Worst case:** Keystone is self-custody, so the device cannot be frozen, but anyone who gets your recovery phrase can empty every wallet it backs up. After the Oct 2026 store breach, scammers holding real names, addresses and order details can send convincing refund or 'replacement device' messages to get your phrase.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Buy only through keyst.one, typed in yourself or from a bookmark, and never from links in unexpected emails, texts or letters; for anything that looks wrong, contact support@keyst.one (Keystone's post-breach guidance)

2. Check firmware against Keystone's verification guides in its GitHub docs before installing an update (KeystoneHQ/Keystone-developer-hub: application and secure-element update package verification)

3. Never enter your recovery phrase on a website, in an app or on a device you did not order, and ignore breach, refund or replacement-device messages that ask for it; Keystone says it never asks for recovery phrases or private keys

## What it can do with your money

| Who holds the keys | You hold the keys Self-custody, air-gapped hardware wallet: the device has no WiFi, Bluetooth or NFC and signs through QR codes. Bitcoin Magazine says seeds can be generated on the device itself and that the Keystone 3 Pro erases stored keys if it detects physical tampering. [source](https://bitcoinmagazine.com/business/crypto-wallet-maker-keystone-debuts-bitcoin-only-firmware-keystone-3-pro) |
| --- | --- |
| Can funds be sent out to any address? | Yes. You sign every transaction on the device yourself; the companion app builds the transaction and broadcasts it once signed. Anyone who has your recovery phrase can do the same from another device. [source](https://apps.apple.com/app/id1567857965) |

## Official links

**Not fully confirmed.** Some of these links were confirmed in only one place, so treat them with care.

- Website: `keyst.one`

- X: `@KeystoneWallet`

- GitHub: `github.com/KeystoneHQ`

- App: `https://apps.apple.com/us/app/keystone-nexus/id6742313403`

- App: `https://apps.apple.com/app/id1567857965`

Where we confirmed these
- https://github.com/KeystoneHQ/keystone3-firmware (KeystoneHQ repo; About lists official website https://keyst.one/; FAQ points to a firmware verification guide docs/verify.md; contact eng@keyst.one)

- https://apps.apple.com/us/app/keystone-nexus/id6742313403 (Keystone Nexus, 'official companion app for the Keystone 3 PRO'; seller YANSSIE HK LIMITED; developer website https://keyst.one; privacy policy on keyst.one; v1.3.5)

- https://apps.apple.com/app/id1567857965 (Keystone Hardware Wallet, 'Companion for Keystone', iPhone only; same seller YANSSIE HK LIMITED; privacy policy on keyst.one; v1.4.0, 2024-07-22)

- https://en.bitcoin.it/wiki/Keystone (third-party: official website keyst.one)

- https://bitcoinmagazine.com/business/crypto-wallet-maker-keystone-debuts-bitcoin-only-firmware-keystone-3-pro (third-party: official website keyst.one, firmware downloads at keyst.one/firmware, firmware open source on GitHub)

- https://cryptobriefing.com/keystone-data-breach-exposed-2026/ , https://news.bitcoin.com/security/keystone-wallet-data-breach-exposes-buyers-addresses-to-scammers/ and https://safeguard.sh/resources/blog/keystone-hardware-wallet-shopify-store-breach-customer-shipping-data (three outlets each cite https://x.com/KeystoneWallet/status/2114054080754770137 as Keystone's own breach statement, and advise typing keyst.one directly and using support@keyst.one)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2026-10-24 | Keystone disclosed unauthorized access to its official website (detected Oct 20; it confirmed on Oct 23, after reviewing API activity with Shopify, that a third party took customer shipping information). Exposed: names, contact details, shipping addresses and order details (items and prices). Keystone says payment card or bank details, recovery phrases, private keys and wallet passwords were not exposed (not independently verified). Keystone warned scammers may pose as Keystone by phone, text, email or mail and offer refunds, replacement devices or order/address 'fixes'. |  | Keystone says it blocked the access, patched the vulnerability, opened an investigation and is emailing affected customers; a detailed report was promised 'in the coming days' and had not appeared as of Oct 25. Number of customers, attack method and the Shopify app or credential involved were not disclosed. No loss of funds was reported. | [source](https://cryptobriefing.com/keystone-data-breach-exposed-2026/) |

## Check a link

Got a link, @handle or repo that claims to be Keystone? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Keystone

We email you if we add an incident, a freeze report, a known fake or a deadline for Keystone. Free; unsubscribe anytime.

## More checks: Wallets
[Phantom](https://tradingagentstack.com/check/phantom/)[MetaMask](https://tradingagentstack.com/check/metamask/)[Rabby Wallet](https://tradingagentstack.com/check/rabby/)[Trust Wallet](https://tradingagentstack.com/check/trust-wallet/)[Exodus](https://tradingagentstack.com/check/exodus/)[Backpack](https://tradingagentstack.com/check/backpack/)[Solflare](https://tradingagentstack.com/check/solflare/)[Coinbase Wallet](https://tradingagentstack.com/check/coinbase-wallet/)[Electrum](https://tradingagentstack.com/check/electrum/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)