Keystone

The Keystone 3 Pro has a 4-inch touchscreen and a camera, and in air-gapped mode it never connects to anything. A companion wallet (MetaMask, Rabby, OKX Wallet, Sparrow, Keystone's own Nexus app and others) builds the unsigned transaction and shows it as a QR code. The Keystone scans it, displays the full transaction for approval, signs, and shows the signature as a QR code for the phone or computer to scan back and broadcast. MicroSD is the alternative channel for large files.

Keys sit behind three secure chips from two vendors, with seed data and fingerprint data stored separately. The device also supports Shamir (SLIP-39) backup, up to three wallets on one device, a fingerprint unlock, and an anti-tamper mode that wipes internal data if the case is opened. A Bitcoin-only firmware is available for people who want the smaller codebase. Limited editions co-branded with OKX, Safe and Solflare ship the same hardware.

1. 01Build the transaction in the companion wallet; it appears as a QR code on screen.
2. 02Scan it with the Keystone camera and read the decoded details on the 4-inch display.
3. 03Approve with PIN or fingerprint; the Keystone shows the signature as a QR code.
4. 04Scan that code back into the companion wallet, which broadcasts the transaction.

The trade-off is speed and fiddliness: a large multisig or NFT transaction may need an animated sequence of QR frames, and poor lighting slows the camera. In exchange there is no cable or radio a compromised computer could use to talk to the device. Firmware updates arrive the same way, from a file on a microSD card, and the device checks the signature before installing.

Our scored review: Keystone 3 Pro review.

Mostly, and Keystone is specific about where it stops. The Keystone 3 firmware is public on GitHub with a guide to build it and compare the checksum with what runs on your device, and the hardware schematics and bill of materials are published. What is not public: some third-party microcontroller libraries under vendor licence, and the internal firmware of the secure-element chips, which no consumer wallet maker controls.

Keystone lists audits by SlowMist and Keylabs and runs a bug bounty. In January 2024 a firmware vulnerability found with the security firm Offside Labs was patched in version 1.2.8; no user losses from it were reported.

The project started in 2018 and sold its first devices as Cobo Vault before rebranding to Keystone. The current operator, Yanssie HK Limited, was incorporated in Hong Kong on 23 February 2021 and lists its office in Kowloon. Devices are manufactured in China. For most buyers that is a detail; for anyone whose threat model includes state-level supply-chain interference, it is the main question to settle before buying, and the published schematics and reproducible firmware are the tools for settling it.