The Keystone 3 Pro is one of the most feature-rich air-gapped wallets on the market. It signs transactions exclusively via QR codes (with microSD as an alternative), using its USB-C port for power only — there is no USB-data, Bluetooth, WiFi or NFC signing path, which is the strongest form of air-gap. It stacks three secure elements, a fingerprint sensor, an anti-tamper self-destruct circuit that wipes keys if the device is opened, and a large 4-inch 480x800 touchscreen that makes verifying addresses genuinely comfortable. At around $149 with support for thousands of assets and dozens of software wallets, the spec sheet is excellent.
The air-gap is the headline and it is real. Because the device never establishes a data connection, the entire class of USB and wireless attack vectors is designed out; a compromised computer can hand the Keystone an unsigned transaction as a QR code and receive a signed one back, but it has no channel to reach the keys. The three secure elements split duties — two guard key material, and a dedicated chip protects the fingerprint data — so no single chip holds everything. The device is uniquely well-integrated with wallets like MetaMask over QR, which is a nice practical touch.
Openness is where the honest asterisks begin. Keystone publishes its firmware on GitHub and provides a checksum-verification workflow, and that is meaningfully more transparent than a closed device. But the build is not fully reproducible: the MH1903 microcontroller library and the QR-code library ship as pre-compiled binaries due to IP restrictions, which independent guides like Michael Flaxman's 10x Security guide flag directly — with binaries in the mix, you are partly trusting code you cannot rebuild from source. That same critique notes the device runs an Android-based OS, a larger and busier attack surface than the minimal firmware on a Coldcard or BitBox.
To Keystone's credit, its security process is visible. A Keylabs audit in late 2023 found one high-severity issue (an inadequacy in the tamper-response circuit) plus several low-severity findings, all reported resolved, and in 2024 Offside Labs disclosed a firmware vulnerability that was neutralized in version 1.2.8. Publishing these is the right behavior and better than silence. It is also a reminder that the self-destruct and secure-element story is not magic — the tamper response itself needed fixing — so treat the marketing claims as engineering in progress rather than guarantees.
Then there is origin. Keystone was formerly Cobo Vault, built by a China-founded team originally serving Chinese Bitcoin miners, and rebranded to Keystone in 2021; the devices are manufactured in China. For many users this is a non-issue — open code and an air-gap are exactly the mitigations that reduce how much you must trust any manufacturer. But for buyers who factor geopolitics and supply-chain provenance into key-management hardware, it is a legitimate consideration worth naming plainly rather than dismissing. Combined with the partial reproducibility, it is the main reason a strong device doesn't score higher here.
The verdict is that the Keystone 3 Pro is impressive hardware with a couple of trust caveats you should decide on with open eyes. If a true air-gap, a big readable screen and broad wallet support are your priorities, and you are comfortable with the origin and the not-fully-reproducible build, it is one of the most usable air-gapped wallets available. If you demand end-to-end reproducible open-source builds or are uneasy about China-manufactured key hardware, the BitBox02 or Coldcard answer those specific worries more cleanly.