Keystone Hardware Wallet

Our latest iOS app update is now live!

Update now 🫡

Your wallet app shows a Zcash address. How do you know it's yours?

Unified Addresses rotate for privacy, so the u1... you see today may not match last week's. That part is normal.

But trusting it without checking isn't.

Keystone can check it against your account. Watch 👇

📣 Nexus App security update: please update to v1.3.7

Some Nexus App services were recently hit by a cyberattack, and some of you couldn't use the app normally for a period. Sorry for the disruption.

Our team responded right away and hardened server security. Based on our investigation so far, we've found no evidence that user assets or personal information were affected.

v1.3.7 adds further security hardening. Update as soon as you can:
• Android: live now on Google Play
• iOS: awaiting App Store review. Until it's live, you can sign with any Keystone-supported third-party wallet (full list: [link])

Before installing, check that the developer is listed as "Yanssie HK Limited". Anything else is not us.

We'll keep strengthening the security and stability of our Nexus services and share updates here.

Dear Keystone fam,

The order check page we promised is now live. Enter the email you used to place your order and see whether you were affected by this incident.

Check here: keyst.one/order-impact-c…

How to check
• Enter the email address you used when you placed your order.
• Complete the CAPTCHA.
• If you see "No matching record found," you were not affected.
• Double-check that you entered the exact email from your order. If you've ordered with more than one email, check each one.

Common questions

Does the page store the email I enter?
• No. Your email is only used to look for a match. The page doesn't store it.

How is affected user data stored? Could it leak again?
• We only use email addresses to match affected users.
• Every email is hashed before it goes into the database, so no plaintext addresses are stored.
• Anyone who accessed the database directly would see hashes, not actual email addresses.

Why do I see "Unable to complete your query"?
• We added CAPTCHA verification to stop bots from abusing the page.
• If the CAPTCHA fails or isn't completed, your query won't go through. Complete it and try again.

Note:
• Our check page only asks for your email. Anything asking for your recovery phrase, private keys, or a payment is a scam.

Got doubts/suggestions? Drop it in the replies, and we'll help.

Dear Keystone fam,

As promised, here's an update on your personal data. We now erase it 90 days after your purchase date, and the process runs every day.

Older records are cleared
• On Oct 24, we started erasing personal data from all customer records older than 90 days.
• On Nov 3, we confirmed that all personal data in those records has been erased.

How it works from here
• Every day, an automated workflow finds orders that are 80 days past their purchase date.
• It sends Shopify a request to erase the personal data tied to those orders.
• Shopify applies a 10-day waiting period, so your data is deleted once your order hits 90 days.

How we make sure it happens
• The automated workflow runs every day.
• A report after each daily batch helps us track the process and catch problems fast.
• A manual review on the 25th of each month finds any data that was missed or not deleted.

Less data stored means less data at risk of exposure.

Scammers may use news like this to pose as Keystone, offering refunds, replacements, or help "confirming" your data deletion. None of it is from us.
• NEVER share your recovery phrase or private keys. We will never ask for them.
• NEVER enter your recovery phrase into a device you didn't order.
• Don't click links in unexpected messages. Type keyst.one into your browser yourself.
• Reach us here on X or at support@keyst.one.

Questions about your data? Drop them in the replies, and we'll answer.