Keystone Hardware Wallet✓

Dear Keystone fam, We know this has been a stressful week, and many of you have questions. Here are answers to the ones we’re hearing most. → I bought my device in 2024/2025/2026. Am I affected? If you placed an order from 2024 to 2026, your shipping data may have been exposed. We’re building a page where you can check whether you’re affected, and we’ll share it here as soon as it’s live. → The authentication key was exposed. How can I verify a device delivered before Oct 20? Our device verification page still runs on the old authentication key, so you can still use it to verify an unopened Keystone. The attacker has that key now, but it doesn’t affect devices that were already delivered before Oct 20. → I already use my Keystone. Can I keep using it? Yes. If you received it before Oct 20, verify it on our website and keep using it as normal. → I received my device on/after Oct 20. What should I do? With the key exposed, attackers could build a fake device with the real key inside, making it look genuine. Contact our support team right away at support@keyst.one, and they’ll walk you through the next steps. → My order is in transit. What should I do? Refuse the package when it arrives and email us at support@keyst.one. Our support team will help you from there. → Is it safe to place a new order on your website? Yes. Because of the key leak, we’ve set aside all existing Keystone 3 Pro inventory to be destroyed. Any order you place now is a pre-order from a fresh batch with new authentication keys, expected to arrive in 4 to 6 weeks. If you’re OK with the wait, go ahead and order. → Is it still safe to update my Keystone’s firmware? Yes. Your Keystone only installs firmware signed by our team. The key that leaked is our web authentication key, which is completely separate from our firmware signing key. Firmware updates are safe, so you can update and keep using your device as normal. ⚠️ Remember, scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or “fixes” for your order or address. None of it is from us. We will never ask for your recovery phrase or private keys. NEVER share them with anyone, and NEVER enter your recovery phrase into a device you didn’t order. Don’t click links in messages you weren’t expecting. Type into your browser yourself. Need help? Reach us directly here on X or at support@keyst.one Once again, we’re sorry we let this happen. We’re doing everything we can to make it right and to help every affected user through it. Still have questions, or think we missed something? Drop them in the replies, and we’ll help.

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.

Most people think linking a hardware wallet to a software wallet exposes your keys 🤔 It doesn’t. Keystone shows a QR code of your xPub, a one-way derivation of your private key. Nexus scans it & derives your addresses locally. Your keys never go online. That’s air-gapped 🧊

Side effects of using a Keystone hardware wallet with the Nexus app 👀 🥶 Your keys stay cold 🛡️ Hackers stay away 🔍 What you see is what you sign ☮️ Life gets a lot less stressful Anyone else experiencing these? 😉

⚠️ If your seed phrase has ever touched an online device, assume it’s compromised. Move to an air-gapped signer like Keystone 🫡

Your hardware wallet shouldn't need to stay connected to protect your crypto. With air-gapped QR signing: → Review the transaction → Sign offline → Scan the signed transaction back No direct USB or Bluetooth signing connection. Keep your keys offline. Keep control in your hands. 🔐

12.8s to 150ms finality 🚀 Huge congrats to @anza_xyz and @solana on shipping Alpenglow, and to every validator who made the switch! Solana fam, next time you send a txn, don’t blink.

Alpenglow is now live on Solana mainnet. ⛰️ Finality just went from ~12.8 seconds to ~150ms. The biggest consensus upgrade in Solana’s history, built by @anza_xyz.

📣 The Ledger supply chain attack is a wake-up call for every hardware wallet maker. Us included. And we’re treating it like one. Here’s what that means: Our team is auditing our entire supply chain, starting with how we vet and manage resellers, and tightening controls wherever this kind of attack could slip through. On the device side, the Keystone 3 Pro already ships with anti-tamper protection, and we’ll make it even tougher in every device that follows. Keeping your keys safe is the reason Keystone exists. We’ll work every day to stop attacks like this before they ever reach you. Huge thanks to the whole Keystone community for your continued support 💙

Into @Zcash & on-chain privacy? 🛡️ All it takes: 1. A Keystone 3 Pro 2. Connect to @zodl_app/@vizorwallet 3. Move your $ZEC from CEX to Keystone & shield it. That's it. Full privacy, air-gapped security under your control 🔐

It started 10 years ago a codebase fork of Bitcoin with privacy built into the protocol the first real-world implementation of zero knowledge proofs

Clear-signing isn’t just for experts ⚠️ Small swap or big transfer, you should know exactly what you’re signing. Start the txn on Nexus, then check every detail on your Keystone screen. Here’s what that looks like 👇

Fire, floods, faded ink. Paper loses to all three If your seed phrase lives on paper, so does your Bitcoin. @dhoneysett shows why metal wins and how Keystone's tablets stack up. Watch it before you trust paper again:

Any project can call itself "quantum-resistant" today. There's no shared way to check. The Quantum Alliance launched to fix that, and Business Insider has the story. We're building open standards and public test criteria for chains, wallets, and infra with @QuantusNetwork, @midnightfdn, @hackenclub, @quipnetwork, @thevault_soft, @PQabelian, @intmaxIO, and @Americanfort_io. Our CTO, @aaron1sme, will represent Keystone on wallet security and build on existing work toward common specs, from secure elements to recovery flows. Read it here 👇

RT @LewiczMichal: Są portfele sprzętowe i portfele sprzętowe. 🔐 Keystone ma system zabezpieczeń, który reaguje na próbę ingerencji we wnętrze urządzenia. Na wideo możecie zobaczyć, jak działa to w praktyce: po naruszeniu zabezpieczeń portfel staje się bezużyteczny.

1/ Your Zcash wallet hands you a fresh receiving address every time. Great for privacy. But how do you know that address is really yours? Keystone firmware v3.1.4 lets you check it on your device before you share it. Update your Keystone 3 Pro and try it out.

2/ Curious how the verification works and how Keystone tells each address apart? We broke it all down here:

Clear-signing is for everyone ✨ Firmware v3.1.4 sharpens transaction parsing for SOL and TRX, so you know exactly what you’re signing before you hit confirm. Wallet setup got smoother too. Holding SOL or TRX? Update your Keystone today 💪

🚨 1,404 Qubic wallets just got drained for about $1.3M. Older Qubic wallet versions generated seed phrases with weak randomness, and an attacker worked out the keys. Qubic halted the network, and most of the stolen funds are frozen for now. Why updating the app won't save you: → A seed phrase is just a random number written as words. → If that number isn't random enough, someone else can regenerate it. → The v4.26.4 fix only protects seeds made after the patch. You're exposed if you made your seed before Oct 18 in any browser on an iPhone or iPad, in Safari on a Mac, or in the iOS app before July 2025. If that's you, update the Qubic wallet, generate a new seed, and move your funds once the network is back up. Treat the old seed as burned. For long-term holdings, go further: → Get a hardware wallet and generate a fresh seed on the device itself. → Write it down, store it somewhere safe offline, and keep it off your phone, your photos, and the cloud. Keystone builds your seed offline from three separate sources of randomness, plus your own dice rolls if you want.

Security incident update. Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU. Here is what happened, what has been done, and what comes next.

What if someone gets to your Keystone 3 Pro before you do? 👀 You’ve asked us this a lot, so we put it on camera 💥 Watch to the end and share it with anyone who’s asked you the same thing 🫡

We’re joining @QuantusNetwork’s Quantum Alliance. Our CTO @aaron1sme will represent Keystone on wallet security and build on existing work toward common specs, from secure elements to recovery flows. Post-quantum keys shouldn’t need a different setup for every wallet.

Ever wondered what happens when someone tries to tamper with a Keystone 3 Pro? You’ll see it today. Stay tuned.

“Post-quantum” is now a marketing buzzword. We’re here to separate the legit tech from the vaporware. Today, ten contributors from across the industry launch the Quantum Alliance. This open standards body will define blockchain quantum readiness. Contributors submit proposals and earn support through evidence and working code. Founding contributors: @YuviLightman, @QuantusNetwork @MehowHacks, @Americanfort_io @HiokiLeona, @intmaxIO @aaron1sme, @KeystoneWallet @SebastienGllmt, @midnightfdn @cadillion and @rcarback, @quipnetwork @PQA_Rich, @PQabelian @bizdevving, @thevault_soft @katina_messinis, @hackenclub