Hardware review — Keystone
Keystone 3 Pro review: no cable, ever
Most hardware wallets plug into your computer. The Keystone 3 Pro refuses to — USB is charge-only and every transaction crosses the gap as a QR code. It is the most convincing air-gapped multi-chain signer you can buy.
- 3 Independent secure element chips
- QR only USB charges the battery and nothing else
- Open Firmware published and reviewable
- ≈NZ$255 Landed cost, indicative
At a glance
The most convincing air-gapped multi-chain signer: no cable ever touches your computer.
Best for: True air-gap without giving up a phone-sized screen · Maker: Keystone
What the air gap actually buys you
A normal hardware wallet plugs into your computer over USB, and that cable is a data path. The security model says it does not matter: what crosses the wire is a signature rather than a key, and the device's own screen tells you what you are approving. That model is sound, and for the overwhelming majority of people it is entirely sufficient.
The Keystone 3 Pro removes the cable anyway. USB-C charges the battery and carries no data. Every transaction crosses the gap as an image: your wallet app renders a QR code containing the unsigned transaction, the Keystone's camera reads it, the device displays the amount and destination on its own screen, you approve, and it shows a QR code containing the signature for your phone to read back.
What this eliminates is an entire class of attack rather than a specific one. There is no USB stack to exploit, no driver to attack, no firmware update path over a cable, and no possibility of a malicious host enumerating or interrogating the device. Whether that matters to you is a question about your threat model, not about the engineering — and for a device holding a serious long-term position, or serving as one key in a multisig arrangement, we think it clearly does.
Specifications
| Maker | Keystone |
|---|---|
| Price | US$129 |
| Form factor | Phone-sized device with a colour touchscreen and camera |
| Secure elements | Three independent secure element chips |
| Source code | Firmware open |
| Connection | QR codes only — USB-C is charge-only, no data path |
| Power | Rechargeable battery; can also run on AAA batteries in some configurations |
| Backup | BIP39 recovery phrase, optional passphrase; supports Shamir backup |
| Asset support | Multi-chain, including Bitcoin and EVM networks |
| Companion apps | Keystone app plus third-party wallets that support QR signing |
| Staking | Via companion apps rather than natively |
| NZ availability | Direct import from keyst.one; no local reseller |
| Last verified | September 2026 |
Living with QR signing
The reasonable objection to air-gapped devices is that the workflow sounds exhausting. Having used it, our honest assessment is that it is about ten seconds per transaction and the friction is real but modest.
What actually makes it feel slow is not the scanning, it is the choreography. You need the phone and the device both in view, both hands free, and reasonable lighting. Doing it at a desk is fine. Doing it standing in a queue is not. And you need a companion app that supports the workflow — the Keystone app does, and so do a number of third-party wallets, but not every wallet you might want to use.
The practical conclusion is the same one we reach on nearly every page here: this belongs in a two-wallet setup. Keystone holds the savings you touch a handful of times a year, where ten seconds of QR choreography costs you nothing. A phone wallet holds the working balance you actually transact with. Trying to make one wallet serve both purposes is how people end up abandoning good security for convenience. See how many wallets you actually need.
Three secure elements, and why more is genuinely better here
The Keystone uses three independent secure element chips rather than one. This is not a specification-sheet flourish; it is the same defence-in-depth logic behind BitBox02's dual-chip design and the Trezor Safe 7's three-layer architecture.
The reasoning is straightforward. A single secure element is a single thing to attack, and the history of this industry — including Ledger Donjon's 2026 laser fault-injection work against Tangem — shows that certified silicon can still be faulted by a sufficiently determined and well-funded attacker. Splitting responsibility across multiple components means an attack has to succeed multiple times against parts with different characteristics, which raises the cost far more than linearly.
Combined with the air gap and open firmware, that gives the Keystone the second-highest security architecture score on this site at 9.3, behind only the Coldcard Q. For US$129, that is a remarkable amount of engineering.
Where a Keystone earns its keep
As one of the keys in a two-of-three multisig. Combining devices from different manufacturers with different architectures means a firmware flaw or a supply-chain compromise affecting one brand cannot spend your funds on its own. A Keystone plus a Trezor plus a Coldcard is a genuinely robust arrangement, and it is what we would build for an amount that would change our life.
The balance sheet
What we like, and what we don't
What it does well
- True air-gap — no data ever crosses between the device and a networked machine, because there is no data path to cross
- Three independent secure elements, so no single compromised component yields the seed
- Open firmware, so the security claims are verifiable rather than asserted
- A large touchscreen makes address verification genuinely easy, which is where most real losses happen
- Multi-chain support, so air-gap is not restricted to Bitcoin holders
- Works with third-party wallets that support QR signing, so you are not locked into one app
- Excellent value at US$129 for this level of architecture
What we hold against it
- No New Zealand reseller — a one to three week import for everyone here
- QR workflow needs two hands and a compatible app; awkward for frequent use
- A battery is a consumable, and a device with a battery has a finite lifespan in a way a passive USB stick does not
- No native staking; delegation requires a companion app
- Smaller ecosystem than Ledger or Trezor means less community troubleshooting material
- The camera is a component that can fail, and if it does the air-gap workflow fails with it
The battery question
One thing worth thinking about before you buy: the Keystone has a rechargeable battery, and batteries are consumables.
A passive USB device like a Ledger Nano S Plus or a Trezor Safe 3 has essentially no components that degrade with time. Leave one in a drawer for eight years and it will work when you plug it in. A device with a lithium cell will not necessarily do that — cells self-discharge, swell, and eventually fail, and a swollen cell in a sealed device is not something you want in a drawer with your paper records.
This does not matter if you understand it, because the recovery phrase is the actual asset and the device is replaceable. But it does mean that a Keystone left untouched for a decade is a device you should expect to replace rather than revive, and it argues for checking on it occasionally rather than treating it as a set-and-forget object. Some configurations can run from AAA batteries, which helps.
The general principle is worth internalising: for very long horizons, the durable part of your setup is the backup, not the hardware. Our backup guide covers steel plates and why they matter more than the device does.
Buying one in New Zealand
No local reseller stocks Keystone, so this is a direct import. Expect one to three weeks depending on carrier. Fifteen percent GST is normally collected at checkout for goods valued under NZ$1,000, and from 1 April 2026 New Zealand Customs applies a Low-Value Goods levy of NZ$2.21 for air freight plus GST per consignment. On a US$129 device, landed cost works out to roughly NZ$255 including shipping — an indicative estimate rather than a quote.
As with every direct import, you forgo practical Consumer Guarantees Act cover and you put your name and street address into an overseas retailer's database. Given what happened after the Ledger customer data leaks, we would send it to a parcel locker or a collection point rather than your home. Our New Zealand buying guide covers the alternatives, and if the wait is unacceptable, The Bitcoin Shop in Tauranga stocks Coldcard Q and Blockstream Jade — both air-gap capable — with domestic dispatch.
From our testing notes
The QR workflow did something we did not anticipate: it made testers pay attention. On USB devices, confirmation becomes a reflex — plug in, press twice, done. With QR signing there is a deliberate pause while the camera focuses and the transaction renders on screen, and in that pause people read what they are about to approve. The friction we thought was a cost turned out to be part of the security.
Keystone 3 Pro FAQ
Keystone 3 Pro — questions New Zealanders ask
What does air-gapped actually mean on the Keystone 3 Pro?
It means there is no data connection between the device and your computer or phone at any point. The USB-C port charges the battery and does nothing else. Every transaction moves as a QR code: your wallet app displays a code containing the unsigned transaction, the Keystone's camera reads it, the device shows you what you are signing, you approve, and it displays a QR code containing the signature which your phone then reads back. No cable, no Bluetooth, no NFC, no scenario in which a compromised machine talks directly to the thing holding your keys.
Is the QR code workflow annoying in practice?
Less than you would expect — about ten seconds per transaction once you have done it twice. The genuine friction is that it needs two hands and a companion app that supports the workflow, and it is awkward if you are standing up. For a savings wallet you touch a few times a year that is irrelevant. For a wallet you use weekly it becomes a real consideration, and the honest answer is that you want a hot wallet for the frequent activity and this for the savings — see how many wallets you need.
Can I buy a Keystone 3 Pro in New Zealand?
Not from a local reseller. Keystone ships internationally, so this is a direct import of roughly one to three weeks. Fifteen percent GST is normally collected at checkout for goods under NZ$1,000, plus the NZ$2.21 Customs Low-Value Goods levy and GST on it from 1 April 2026. Landed cost is around NZ$255 on a US$129 RRP — indicative. If you want an air-gapped device with a shorter wait, The Bitcoin Shop in Tauranga stocks Blockstream Jade and Coldcard Q.
Why does the Keystone have three secure elements?
Redundancy and separation of duties. Rather than one chip holding everything, three secure elements split the work so that compromising a single component does not yield the seed. It is the same defence-in-depth reasoning behind BitBox02's dual-chip design and Trezor's three-layer Safe 7 architecture, taken a step further. Combined with the air gap, it gives the Keystone the second-highest security architecture score on this site.
Next in this cluster