Keystone
Keystone HK Limited
Data verified on unchanged since the sources
Worth it if you want a genuinely air-gapped cold wallet: QR-only signing, no Bluetooth and no USB data path, with three secure elements and open-source firmware.
Avoid it if you sign constantly and want a plain USB connection: here every signature goes through QR codes read with your phone camera and the companion app.
Keystone is an air-gapped hardware wallet: it has no Bluetooth, Wi-Fi, NFC or USB data path, and signs every transaction via QR codes exchanged with the companion app. The Keystone 3 Pro model (≈€150) packs three Infineon secure elements (two certified CC EAL5+), a 4-inch touchscreen and a fingerprint reader. Firmware is open-source and the device works with third-party wallets such as MetaMask. It is made by Keystone (a Hong Kong-based company).
Data & conditions
| Fund custody | Self-custody (funds in your control) |
|---|---|
| Type | Hardware (cold storage) |
| Source code | Partly open-source |
| Recovery | Seed phrase 12/24 parole (BIP-39); supporto multi-seed |
| Bitcoin-only | No |
| Supported chains | Bitcoin, Ethereum, Solana, Polygon, BNB Chain |
| Price | €150 |
| Secure element | Yes |
| Air-gapped | Yes |
| Connectivity | QR, microSD |
| Companion app | Keystone App |
| Built-in swap | No |
| Built-in staking | No |
| WalletConnect | No |
| Segment | B2C |
| MiCA / License status | Nessuna (hardware wallet self-custody) |
Plans & pricing
Strengths
- Genuinely air-gapped (QR signing, no USB/Bluetooth data); triple Infineon secure elements (2x EAL5+); open-source firmware; large touchscreen and fingerprint reader.
- Self-custody: funds stay in your wallet — the platform cannot touch them.
- No KYC: usable without identity verification.
- Self-hostable: you can run your own instance or node.
Weaknesses
- QR signing flow is more cumbersome than plain USB; requires the companion app and a phone camera; brand less known in Europe than Ledger/Trezor.
- No notable sovereignty drawback documented.
Verdict
Score 4.4/5, very strong profile. In its favour: genuinely air-gapped (QR signing, no USB/Bluetooth data); triple Infineon secure elements (2x EAL5+); open-source firmware; large touchscreen and fingerprint reader. The trade-off to weigh: qR signing flow is more cumbersome than plain USB; requires the companion app and a phone camera; brand less known in Europe than Ledger/Trezor.
On the Sovereignty lens the score is 4.3/5 (very strong): the strength is fund control (5.0/5), while trustless / auditability (2.5/5) is the weak link.
Promp's editorial rating based on real fees and net annual cost. Promp reviews third-party products independently.
"Sovereignty" rating: score computed on privacy/anonymity (30%), fund control (20%), censorship resistance (20%), trustless/auditability (20%) and costs (10%). Same data, different weights.
Reputation
What happened to people who used Keystone, and what users say. External signals: they do not feed the promp.it rating.
Incidents & regulatory actions
Notable incidentsDocumented events with consequences still open. Each entry carries a source and a date.
-
Data breach Severe ● open
Official website breach: data of 25,964 customers and the key that certifies device authenticity exposed
On 20 October 2026 Keystone detected unauthorised access to its official website. In its 26 October post-mortem the company explains that the attacker exploited a vulnerability in a third-party data monitoring tool used by the site to escalate privileges: the flaw is therefore in the e-commerce site, not in the firmware. Exposed: 25,964 buyer records from the Shopify store (2024-2026) with names, contact details, shipping addresses and orders, kept beyond the intended 180 days because the automated erasure tool was failing; plus 12,873 unpaid checkouts with names, contacts and addresses. Purchases via Amazon and other channels were not affected. The attacker also obtained the WebAuth key the authentication page uses to verify that a device is genuine: it is written at manufacturing and cannot be changed, so it could be used to build counterfeit devices that pass the check. Keystone says it has switched to a new key in production, is destroying the 18,835 units in stock carrying the old key and has suspended shipping of website orders (moving to pre-orders). Not involved, per the company: recovery phrases, private keys, wallet credentials, payment data and ID documents. No theft of funds reported. Erasure of overdue data was requested from Shopify on 24 October, with completion expected on 3 November; reports have been filed with authorities in the EU, the UK and elsewhere.
↗ source
verified on
Public reviews
-
Trustpilot ↗
4.6/5
724 reviews
Read from uk.trustpilot.com (the .com returns 403): 4.6 over 724 reviews. Measures the Keystone company/service (keyst.one), not specifically the device.
-
App Store ↗
2.6/5
36 reviews
Exact figure from itunes.apple.com/lookup (companion app 'Keystone Hardware Wallet', id 1567857965): 2.6 over 36 ratings. Rates the APP, not the air-gapped device. Small denominator (36).
Weighted average across 2 public review platforms (760 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.
FAQ
How much does the Keystone 3 Pro cost?
The Keystone 3 Pro costs about €150 (€149.90 on the official shop and at European resellers).
Is Keystone really air-gapped?
Yes: it has no Bluetooth, Wi-Fi or NFC and the port is power-only. Every transaction is signed by exchanging QR codes with the app, with no direct data link.
Is Keystone open source?
Yes, the Keystone 3 Pro firmware is open-source and auditable. The device also pairs three Infineon secure elements, two of them certified CC EAL5+.
Sources
- hardware-wallets.net Secure element EAL5 · QR · Companion Data verified on Jun 20, 2026
- shop.keyst.one Prezzo · Air gapped · Secure element · Open source Data verified on Jun 20, 2026