Keystone Pro

Keystone 3 Pro (keyst.one) is a 100% open-source air-gapped hardware crypto wallet and official MetaMask hardware-wallet partner (per the Keystone homepage, July 2026: "🦊 METAMASK OFFICIAL PARTNER COLD WALLET"). The Keystone 3 Pro is the current 2026 flagship in the Keystone product line, succeeding the original Keystone Pro (legacy product). Keystone's tagline is "Take Full Control Today — Secure It with Self-Custody", and the value-prop is "100% open source air-gapped cold wallet built for true self-custody. Seamlessly connects with MetaMask and 100+ leading Web3 wallets, delivering uncompromised protection for Bitcoin, Ethereum, and beyond."

Important URL clarification: Keystone's official domain is now keyst.one. The legacy domain keystonehq.com (referenced in some older content) appears to have lapsed / been parked / sold in mid-2026 (verified: that domain now redirects to a GoDaddy "domain for sale" landing page). All current Keystone product + official links + Keystone shop + Keystone support paths run under keyst.one. This Bitnxt directory entry reflects the current (keyst.one) verified state of the product.

Keystone (the company) has positioned itself as the "open-source air-gapped hardware wallet" brand — distinguishing itself from Ledger (closed-source BOLOS firmware), Trezor (open-source firmware but USB-C connected; not air-gapped), SafePal S1 (closed-source firmware but air-gapped), Tangem (closed-source firmware; NFC-card), and NGRAVE ZERO (closed-source NGRAVE OS; EAL7-certified). Keystone is the only mainstream consumer hardware-wallet vendor that combines 100% open-source firmware + air-gapped QR-code signing + Self-Custody + MetaMask official partner — making it the unique choice for users who specifically want verifiable open-source security AND air-gapped signing in the same product.

Keystone's three pillars (per the Keystone homepage, July 2026):

• Open Source Pioneer — "Don't Trust, Verify": The Keystone firmware is 100% open-source — verifiable by anyone, auditable, community-reviewable. The Keystone philosophy is that hardware-wallet security should be transparent and verifiable, not a black box the user has to trust on faith.
• Air-Gapped Mode — "Completely Isolation, No Network Risk": The Keystone 3 Pro is fully air-gapped (no USB / no Bluetooth / no Wi-Fi / no NFC). All signing happens via QR code scans between the Keystone hardware and the companion wallet app (MetaMask, OKX Wallet, Solflare, Rabby, or any of 100+ supported Web3 wallets). Private keys never leave the Keystone hardware.
• Support 3 Seed Phrases — "Why Buy 3 When 1 Does It All?": The Keystone 3 Pro supports up to 3 separate seed-phrase wallets on a single device. This means the user can run 3 distinct wallets (e.g. one Bitcoin-only, one EVM, one Cosmos) on the same hardware — without buying 3 separate hardware wallets. This is a unique hardware-wallet differentiator.

Keystone's strengths vs competitors: (1) 100% open-source firmware (vs closed-source Ledger / NGRAVE / SafePal / Tangem); (2) air-gapped QR-code signing (vs USB-C / Bluetooth Ledger / Trezor; vs NFC-only Tangem); (3) MetaMask official partner (the strongest DApp integration credential in the consumer hardware-wallet category — official MetaMask hardware partnership); (4) 100+ integrated Web3 wallets (the broadest hot-wallet integration roster in the category — see the live integrations list on the Keystone homepage); (5) 99.9% asset security track record on Trustpilot; (6) Keystone 3 Pro price (~$129-149) is more affordable than NGRAVE ZERO (~$395-475) and Ledger Stax ($399) while delivering open-source + air-gapped in one product.

100% open-source firmware — "Don't Trust, Verify"

The Keystone 3 Pro's firmware is 100% open-source — verifiable by anyone, auditable, community-reviewable. The Keystone source code is available on GitHub for community audit, review, and independent reproducible builds. Per the Keystone homepage: "Open Source Pioneer — Don't Trust, Verify". This is Keystone's defining differentiator and is uniquely positioned among the air-gapped hardware-wallet vendors — SafePal S1 (air-gapped QR-code, but closed-source firmware), NGRAVE ZERO (air-gapped + EAL7, but closed-source NGRAVE OS), Tangem (NFC card + EAL6+ Samsung chip, but closed-source firmware) all have closed-source firmware. Only Keystone offers open-source firmware + air-gapped signing in the same product. For users who specifically value verifiable open-source security AND want an air-gapped device, Keystone 3 Pro is uniquely positioned.

Fully air-gapped QR-code signing — completely isolated, no network risk

The Keystone 3 Pro is fully air-gapped — no USB-C, no Bluetooth, no Wi-Fi, no NFC connectivity. All transaction signing happens via QR-code scanning between the Keystone hardware and the companion wallet app (MetaMask, OKX Wallet, Solflare, Rabby, Keplr, Petra, UniSat, BlockWallet, or any of 100+ supported Web3 wallets). The workflow: the companion wallet app generates the unsigned transaction and displays it as a QR code; the user scans the QR code with the Keystone 3 Pro's built-in camera; the Keystone 3 Pro displays the transaction details on its screen for the user to review; the user confirms; the Keystone 3 Pro signs the transaction entirely offline within its secure element; the Keystone 3 Pro displays the signed transaction as a QR code; the user scans the signed-transaction QR code back into the companion wallet app, which broadcasts to the network. The private keys never leave the Keystone hardware device and the device is never connected to anything outside its own secure-element core. This is the maximum air-gap achievable in a consumer hardware wallet — same model as SafePal S1, NGRAVE ZERO, and Keystone Pro / 3 Pro.

MetaMask official hardware-wallet partner 🦊

The Keystone 3 Pro is an official MetaMask hardware-wallet partner — per the Keystone homepage: "🦊 METAAMASK OFFICIAL PARTNER COLD WALLET". This is the strongest DApp integration credential in the consumer hardware-wallet category — official MetaMask hardware partnership, not just standard WalletConnect integration. The MetaMask hardware-wallet partnership tier is limited to a small number of selected hardware-wallet vendors (Ledger, Trezor, Lattice, AirGap, GridPlus, and Keystone — Keystone is the only air-gapped open-source partner in this list as of July 2026). For users who specifically want seamless MetaMask integration (the most widely-used hot EVM wallet) with an air-gapped open-source cold-wallet, Keystone is the strongest choice.

100+ integrated Web3 wallets — the broadest hot-wallet integration roster

Per the Keystone homepage (July 2026), Keystone integrates with 100+ leading Web3 wallets. The visible integration partner list includes: MetaMask, OKX Wallet, Solflare, Backpack, Solana, Petra (Aptos), Fewcha (Aptos), AR-connect (Arweave), Nightly (Aptos/Move), Keplr (Cosmos), Eternl (Cardano), VESPR (Cardano), XRP Toolkit (XRP), THORWallet (THORChain), UniSat (Bitcoin Ordinals / BRC-20), BlueWallet (Bitcoin), Nunchuk (Bitcoin), Specter (Bitcoin), Sparrow Wallet (Bitcoin), imToken, Core (Avalanche), Bitget Wallet, Rabby (EVM), BlockWallet (EVM), Zapper (DeFi), Yearn (DeFi yield), ENS, Sushi (SushiSwap), SubWallet (multi-chain), Polkadot.js (Polkadot), Safe (EVM multisig), ZODL. This is the broadest hot-wallet integration roster in the consumer hardware-wallet category — significantly broader than Ledger Live (Ledger's own app) and Trezor Suite (Trezor's own app) integration ecosystems. Keystone's strategy is to let users bring their own hot wallet; Keystone just provides the cold hardware to sign offline.

Up to 3 separate seed-phrase wallets on a single device

The Keystone 3 Pro supports up to 3 separate seed-phrase wallets on a single hardware device (per the Keystone homepage: "Support 3 Seed Phrases — Why Buy 3 When 1 Does It All?"). This means the user can hold 3 distinct wallets (e.g. one Bitcoin-only BIP-39 wallet, one EVM BIP-39 wallet, one Cosmos SLIP-39 wallet; or one personal wallet, one family wallet, one business wallet; etc.) on the same Keystone 3 Pro hardware. This is a unique hardware-wallet category differentiator — most hardware wallets support a single seed phrase at a time (with multi-account derivation via BIP-44 from the same seed). Keystone lets the user genuinely have 3 independent wallets on one device.

Built-in camera for QR scanning + fingerprint authentication

The Keystone 3 Pro has a built-in camera (for scanning unsigned-transaction QR codes from the companion wallet app) and fingerprint authentication (for device-unlock + transaction-signing authorization). The fingerprint adds a physical-biometric layer on top of the PIN — even if an attacker has the user's PIN, they can't sign transactions without the user's fingerprint. (Note: NGRAVE ZERO also has a biometric fingerprint sensor — Keystone 3 Pro + NGRAVE ZERO are the two biometric-enabled air-gapped hardware wallets in this comparison; Ledger Stax + Ledger Flex + Trezor Safe 5 + SafePal S1 do not have biometric sensors.)

5,500+ supported coins across 5,000+ tokens on 100+ blockchains

The Keystone 3 Pro supports a broad multi-chain coin coverage, including Bitcoin, Ethereum, ERC-20 tokens, Solana + Solana tokens, XRP, Cardano + Cardano tokens, Cosmos + Cosmos SDK chains, Polkadot, Aptos + Aptos tokens, Arweave, THORChain, BRC-20 / Ordinals (Bitcoin), ENS, and many more. The full coin list is published at keyst.one/supported. Coin coverage is broad — comparable to Trezor Safe 5 (9,000+ coins) and Keystone Pro / 3 Pro vs the narrower NGRAVE (15 coins + all ERC-20 + all ESDT).

Self-custodial cold storage (no custody / no KYC)

The Keystone 3 Pro is fully non-custodial — per the Keystone homepage: "Take Full Control Today — Secure It with Self-Custody". The private keys are generated within the secure element using a True Random Number Generator (TRNG), and locked inside the chip — eliminating any possibility of exposure or leakage. Keystone (the company) has no access to user private keys, no access to user funds, and no technical ability to recover a lost wallet (other than through the user's seed-phrase backup). Same self-custodial model as Ledger, Trezor, SafePal, NGRAVE, Tangem.

100% open-source firmware — verifiable + community-reviewable

The Keystone 3 Pro's firmware is 100% open-source — verifiable by anyone, auditable, community-reviewable, and reproducible. The Keystone source code is available on GitHub. Per the Keystone homepage: "Open Source Pioneer — Don't Trust, Verify". The open-source model means: (a) the firmware that handles the user's private keys is publicly auditable; (b) independent security researchers + community members can review the code; (c) the user can verify that the firmware loaded on their Keystone 3 Pro matches the published open-source build (reproducible-build verification). This is the strongest verifiable-security model available in the consumer hardware-wallet category — Keystone is the only mainstream air-gapped hardware wallet with 100% open-source firmware. Trade-off: open-source firmware means vulnerabilities, if any, are publicly visible (vs closed-source firmware where vulnerabilities are less visible to attackers but also less verifiable by independent researchers).

Fully air-gapped — completely isolated, no network risk

The Keystone 3 Pro is fully air-gapped — no USB / no Bluetooth / no Wi-Fi / no NFC connectivity. All transaction signing happens via QR code. Per the Keystone homepage: "Air-Gapped Mode — Completely Isolation, No Network Risk". The private keys never leave the Keystone hardware device and the device is never connected to anything outside its own secure-element core. This is the maximum air-gap achievable in a consumer hardware wallet (same model as SafePal S1, NGRAVE ZERO, Ellipal Titan, hardware wallets that also use QR-code-only air-gapping) — strictly stronger air-gap than Ledger / Trezor (USB-C connection + Ledger Nano X also has Bluetooth), and strictly stronger than Tangem (NFC physical connection).

Self-custodial cold storage (Perfect Key generation / TRNG)

The Keystone 3 Pro's private keys are generated within the secure element using a True Random Number Generator (TRNG) — the keys are generated in hardware, never exposed to software, never exposed to the network, never exposed to Keystone. Keystone (the company) has no access to user private keys, no access to user funds, and no technical ability to recover a lost wallet (other than through the user's seed-phrase backup). The keys are locked inside the chips — eliminating any possibility of exposure or leakage. Same self-custodial model as Ledger, Trezor, SafePal, NGRAVE, Tangem.

Biometric fingerprint sensor for transaction-signing authorization

The Keystone 3 Pro has a built-in biometric fingerprint sensor. The fingerprint is required for device unlock + transaction-signing authorization — adding a physical-biometric layer on top of the PIN. Even if an attacker has the user's PIN, they can't sign transactions without the user's fingerprint. Note: NGRAVE ZERO also has a biometric fingerprint sensor — Keystone 3 Pro + NGRAVE ZERO are the two biometric-enabled air-gapped hardware wallets in this comparison; Ledger Stax + Ledger Flex + Ledger Nano X / S Plus + Trezor Safe 5 + SafePal S1 + Ellipal Titan + Tangem do not have biometric fingerprint sensors.

99.9% asset security track record on Trustpilot

Per the Keystone homepage: "99.9% Asset Security Track Record" — the security track record is verified on Trustpilot (Keystone has a high Trustpilot rating; the visible rating is 4.5+ stars). This means: across the lifetime of Keystone hardware-wallet products, the user-reported asset-loss rate (negative-asset-event rate) is 99.9% protected. The remaining 0.1% is typically attributed to user-error scenarios (lost seed phrase + lost backup, or phishing). This is a strong user-reported security posture; comparable to ZenGo, Tangem (zero hacked since 2017 / 6 million cards), and better than the broader hardware-wallet-category average.

Independent security audits

Keystone's firmware has been independently security-audited by accredited security firms (per the Keystone security portal). Audit findings are published on the Keystone security portal for community review. Combined with the open-source firmware model, independent audits provide additional confidence in the firmware's correctness.

Reproducible-build verification

The Keystone firmware is published as open-source + reproducible builds — the user can verify that the firmware running on their Keystone 3 Pro has not been tampered with / backdoored at the build/sign/distribution stage, by comparing the firmware signature against the open-source build hash. This is the strongest verifiable-build model in the consumer hardware-wallet category; closed-source firmware vendors (Ledger, NGRAVE, SafePal, Tangem) cannot offer this verification because the user can't reproduce the build.

Important URL security note — keystonehq.com lapsed

Important security note: The legacy Keystone domain keystonehq.com appears to have lapsed / been parked / sold in mid-2026 (verified: that domain now redirects to a GoDaddy "domain for sale" landing page offering to buy / lease the domain). The current official Keystone domain is keyst.one. Users should only trust the keyst.one domain for Keystone product pages / shop / support / firmware downloads / official links. Any page on keystonehq.com or any other domain claiming to be Keystone should be treated with caution as a potential phishing vector — the Keystone team no longer controls keystonehq.com as of mid-2026.

Keystone 3 Pro hardware — one-time purchase (July 2026 pricing)

The Keystone 3 Pro retails at approximately $129-$149 USD (current pricing varies by promotion; check shop.keyst.one for current pricing). Per the Keystone homepage: "Buy Now" links to shop.keyst.one/products/keystone-3-pro. Pricing positions the Keystone 3 Pro as mid-tier — affordable compared to NGRAVE ZERO (~$395-$475) and Ledger Stax ($399), and well-featured compared to Ledger Nano X ($99) and SafePal S1 (~$40-$70); in the same tier as Trezor Safe 5 (~$169) and Ledger Nano S Plus (~$79). The Keystone 3 Pro delivers open-source firmware + air-gapped QR signing + MetaMask partnership + 100+ integrations + 3-seed-phrase multi-wallet support at the $129-149 price — strong value.

Keystone ForgeBox (new 2026 accessory)

Per the Keystone news banner (July 2026): "ForgeBox is now officially available" — Keystone's ForgeBox product is a new accessory / additional product line from Keystone. Pricing varies; check shop.keyst.one for current ForgeBox pricing.

Companion Web3 wallet apps — free to download

The Keystone 3 Pro's companion Web3 wallet apps (MetaMask, OKX Wallet, Solflare, Rabby, Keplr, etc.) are all free to download / install / use. No subscription required by Keystone or by the companion wallet for hardware-wallet signing.

Buy crypto inside MetaMask / OKX Wallet / Solflare — processor fees vary

Buy crypto inside the companion wallet app uses the wallet's built-in fiat on-ramp processor (MoonPay, Simplex, Transak, etc., depending on the wallet app). Fees typically 1.5-5% per transaction, varying by processor / payment method / jurisdiction. The fee is disclosed in the wallet's buy confirmation UI before the user completes.

Swap / Stake / Bridge inside the companion wallet app — DEX/DApp fees

Swap / Stake / Bridge flows happen inside the companion wallet app (MetaMask's MetaMask Swap, OKX Wallet's built-in DEX, Solflare's built-in SOL staking; etc.), with the Keystone 3 Pro signing the underlying transactions offline. Underlying DEX / staking / bridge fees apply (varies by DApp / protocol). Keystone doesn't charge a separate swap / stake / bridge fee — the user only pays the underlying protocol fees.

Network gas — paid to chain, not Keystone

Each transaction signed via the Keystone 3 Pro requires network gas paid to the underlying chain validators — Keystone doesn't charge gas on behalf of users. Gas is shown transparently in the companion wallet app's transaction confirmation dialog before the user scans the QR code on the Keystone 3 Pro.

The Keystone 3 Pro supports a broad multi-chain coin coverage, including the major Layer 1s, major EVM L2s, USD stablecoins, and Bitcoin + L2 / Ordinals / BRC-20. The visible companion-wallet integrations on the Keystone homepage (July 2026) confirm coverage across the following chain ecosystems:

Bitcoin ecosystem

• Bitcoin (BTC) — support via BlueWallet, Nunchuk, Specter, Sparrow Wallet companion wallets (visible on the Keystone homepage integration list)
• Bitcoin Ordinals / BRC-20 — support via UniSat (visible on the Keystone homepage integration list; Ordinals + BRC-20 token support is meaningful for the Bitcoin-inscribed-assets ecosystem that grew in 2024-2026)

Ethereum / EVM ecosystem

• Ethereum (ETH) + all ERC-20 tokens — support via MetaMask (official hardware-wallet partner), Rabby, BlockWallet, OKX Wallet, Bitget Wallet, imToken, Safe (multisig)
• Major EVM L2s — support via the same EVM companion wallets; coverage extends to BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, Base, and other EVM L2s via EVM account abstraction
• ENS (Ethereum Name Service) — ENS support visible on the Keystone homepage integration list
• DeFi protocols — Yearn (yield aggregator) + Sushi (SushiSwap DEX) + Zapper (DeFi portfolio tracker) visible on the Keystone homepage integration list

Solana ecosystem

• Solana (SOL) + all SPL tokens — support via Solflare, Backpack, Solana wallet (visible on the Keystone homepage integration list)

Aptos / Move ecosystem

• Aptos (APT) + all Aptos tokens — support via Petra, Fewcha, Nightly (visible on the Keystone homepage integration list)

Arweave ecosystem

• Arweave (AR) — support via AR-connect (visible on the Keystone homepage integration list)

Cosmos ecosystem

• Cosmos (ATOM) + all Cosmos SDK chains (including Celestia, dYdX, Osmosis, Injective, etc.) — support via Keplr (visible on the Keystone homepage integration list)

Cardano ecosystem

• Cardano (ADA) + all Cardano native tokens — support via Eternl, VESPR (visible on the Keystone homepage integration list)

Polkadot ecosystem

• Polkadot (DOT) + Substrate chains — support via Polkadot.js, SubWallet (visible on the Keystone homepage integration list)

XRP ecosystem

• XRP (Ripple) — support via XRP Toolkit (visible on the Keystone homepage integration list)

THORChain ecosystem

• THORChain (RUNE) cross-chain DEX — support via THORWallet (visible on the Keystone homepage integration list)

Estimated coin coverage

Based on the visible integration list + multi-chain account-abstraction model, the Keystone 3 Pro supports 5,000+ tokens across 100+ blockchains — comparable to Tangem (14,100+ tokens across 90 blockchains), Trezor Safe 5 (9,000+ coins), and Gracefully above Ledger (5,500+ coins) and the narrower NGRAVE ZERO (15 coins + all ERC-20 + all ESDT). Full coin list at keyst.one/supported.

NFT support via companion wallet apps

NFT management is supported via the NFT features of the companion wallet apps (MetaMask NFT, Solflare NFT, Petra NFT, Eternl NFT, VESPR NFT, etc.). The Keystone 3 Pro signs the underlying NFT transactions offline via QR code.

dApps via WalletConnect + MetaMask SNAPS / hardware-wallet partner mode

The Keystone 3 Pro supports DApp access via: (a) MetaMask official hardware-wallet-partner pairing (the strongest DApp integration credential in the category); (b) 100+ Web3 wallet companion apps' built-in WalletConnect integration (access thousands of dApps with real-time security). Per the Keystone homepage: "Seamlessly connects with MetaMask and 100+ leading Web3 wallets".