Keystone 3 Pro setup: step-by-step guide from unboxing to your first transaction

Keystone 3 Pro setup should start with verifying the device and checking a few basic security settings. In this guide, we walk through the entire process step by step, from inspecting the box to signing your first transaction. We based the instructions on Keystone’s official documentation and kept menu labels exactly as they appear on the device.

Keystone 3 Pro is designed primarily for air-gapped operation, without a network connection. The device does not connect to the internet, Wi-Fi, or Bluetooth, and the workflow in this guide transfers data between Keystone and software wallets with QR codes. Keystone 3 Pro also supports USB data transfer for compatible integrations. If you do not need it, you can disable it under [···] > [Device Settings] > [Connection] > [Data transfer with USB]. The USB port will then work for charging only.

The menu paths and firmware requirements in this guide were checked as of September 2026. Before updating, always confirm the current Latest Firmware on Keystone’s official firmware page.

Keystone 3 Pro setup: what you’ll need

Before you start, prepare the following:

• Keystone 3 Pro
• At least 40% battery, which is the minimum required for a firmware update. Fully charging the device before setup is a good idea
• USB-C cable (included) for charging and, if you choose this method, updating the firmware over USB
• If you plan to update via microSD: a 32 GB or 64 GB card formatted as FAT32. Cards up to 512 GB are supported for firmware updates. A microSD card is not included
• A microSD card reader if your computer does not have a built-in card slot
• A computer with internet access to verify the device on Keystone’s website and download firmware
• The paper Secret Recovery Sheet (included) or a metal seed phrase backup
• A pen

How long does the setup take?

The total time depends on the firmware already installed and the update method you choose. Do not rush the initial setup. Give yourself enough uninterrupted time to verify the device, update the firmware, and record the seed phrase carefully.

Step 1. Unbox the device and inspect the packaging

Before opening the box, inspect it carefully. Genuine Keystone packaging is protected with shrink wrap and holographic seals across the seams. Torn wrap, resealed or damaged security seals, glue residue, or obvious wear can indicate that the box was opened before it reached you.

What comes with Keystone 3 Pro

Once the box is open, make sure the contents are complete:

• Keystone 3 Pro with a 4-inch touchscreen
• USB-C cable for charging
• Six Secret Recovery Sheets for recording the seed phrase
• Printed user guide

A microSD card is not included and must be purchased separately if you plan to use that update method.

Step 2. Power on Keystone for the first time

Charge the device

Connect Keystone to a charger or laptop using the included USB-C cable. Firmware updates require at least 40% battery, so it is best to charge the device well above that threshold before you begin.

Use the included cable or another known-good USB-C cable. If the device does not charge, try a different cable and power adapter before assuming there is a problem with the wallet.

Turn the device on

Press and hold the side power button until the Keystone logo appears. The device will then enter the initial setup flow.

Choose the interface language

The first screen asks you to choose the interface language. Select English and tap the arrow to continue.

Step 3. Verify the device (Device Verification)

Device Verification helps confirm that your Keystone is genuine and can flag potential device or firmware issues after delivery. Keystone lets you skip this step, but we recommend completing it on every new device.

To verify the device:

1. On your computer, open Keystone’s official Device Verification page
2. Click [Scan QR Code]. A QR code will appear on the website
3. During initial setup, choose [Device Verification] on Keystone. If you already skipped that screen, return to the home screen and use the scanner/camera icon to scan the verification QR code
4. Point the rear camera on Keystone at the QR code on your computer screen. The device will read it
5. Keystone will display a unique verification code made up of letters and numbers
6. Enter that code into the field on the website and confirm
7. If everything checks out, the website will show [Verification Successful]

Step 4. Update the firmware (Firmware Update)

A brand-new Keystone may still arrive with an older firmware version. Updates fix bugs and security issues and add support for new networks and features. Keystone allows you to skip this step, but we recommend checking the available firmware before creating a new wallet.

If you want a dedicated update walkthrough, see our step-by-step Keystone 3 Pro firmware update guide. It covers microSD, USB, and checksum verification in more detail.

Keystone’s official firmware page offers three branches: Multi-Coin, Bitcoin-Only, and Cypherpunk. Multi-Coin is marked as Default and is the right choice for most users. Bitcoin-Only is intended for Bitcoin-only use, while Cypherpunk covers BTC, Zcash, Monero, and other supported privacy-focused use cases. Unless you intentionally chose a different branch, use Multi-Coin during initial setup and install the current Latest Firmware.

Two ways to update

• Via microSD card. The Keystone does not need to be connected to your computer
• Via USB cable. Simpler, but the device is connected to the computer. This method works only if the currently installed firmware is 1.0.4 or later

In this guide, microSD is the primary update method because Keystone does not need to be connected to the computer, preserving the air-gapped workflow.

Option 1: update with a microSD card

You will need:

• A microSD card up to 512 GB. Keystone recommends 32 GB or 64 GB; format it as FAT32 before the update
• A microSD card reader
• A computer with internet access
• At least 40% battery on Keystone

Update procedure:

1. Format the microSD card as FAT32. On macOS, use Disk Utility. On Windows, use Format > File system: FAT32
2. Open the official Keystone firmware page, choose the required firmware branch, and download the current keystone3.bin file. For most users, Multi-Coin (Default) is the standard choice
3. Copy keystone3.bin to the root of the microSD card, not into a folder. The filename must be exactly keystone3.bin, without suffixes such as keystone3(1).bin, or the device may not detect it
4. Insert the microSD card into the side slot until you feel a light click
5. If the device is still in the initial setup flow, choose [Upgrade] and follow the on-screen instructions. On an already configured device, open [···] > [Device Settings] > [About] > [Firmware Update]. On some firmware versions, [About] is located inside [System Settings]
6. On a configured device, choose [Via microSD Card] > [Update]. During first-time setup, continue through the [Upgrade] flow
7. Enter your PIN if one has already been set. A brand-new device will not ask for it yet
8. Wait for the update to finish. Do not power the device off or disturb it while the update is in progress

Option 2: update over USB

This method is available when the currently installed firmware is 1.0.4 or later. If the device is running an older version, the first update must be performed with a microSD card.

1. Charge Keystone to at least 40%
2. If the device is still in the initial setup flow, open [Upgrade]. On a configured device, go to [···] > [Device Settings] > [System Settings] > [About] > [Firmware Update]
3. Choose [via USB]
4. Connect Keystone to your computer with the included USB-C cable
5. Keystone will ask for permission to allow USB access. Tap [Approve]. Without approval, the USB port remains charge-only
6. On your computer, open the official Keystone firmware page in a supported browser
7. Click [Install Update] and follow the instructions on the page

Step 5. Create a new wallet

You will now set an access code, name the wallet, and generate its seed phrase. If the device is lost, damaged, or reset, you will need the correctly recorded seed phrase to recover the wallet.

Create or import a wallet

After verification and the firmware update, the device offers two choices:

• [Create New Wallet] creates a brand-new wallet. Use this if you are setting up a hardware wallet from scratch
• [Import Wallet] restores a compatible wallet from an existing seed phrase, for example when moving from another hardware wallet

Set a PIN code

Keystone will ask you to set an access code. Its official documentation uses the term passcode: you can use a numeric PIN or a more complex password containing numbers, letters, and symbols. For simplicity, this guide uses a numeric PIN.

1. Choose a PIN that is difficult to guess. For a numeric code, we recommend at least 8 digits
2. Enter the PIN on the touchscreen keypad and double-check it before confirming
3. Enter the PIN again to confirm it

Do not use birthdays, simple sequences such as 123456 or 111111, or the PIN from a bank card. A random number you can reliably remember is a better choice. If you write the PIN down, store it separately from the seed phrase and in a different location.

Name the wallet (Name Wallet)

After you set the access code, Keystone will ask you to name the wallet, for example Main Wallet or Trading 2026. The name is only there to help you tell wallets apart on the device. You can skip this step and rename the wallet later under [Device Settings] > [Wallet Settings]. Do not put personal or confidential information in the wallet name.

Generate and record the seed phrase

A seed phrase, also called a mnemonic phrase, is a sequence of words from the BIP39 word list from which the wallet can deterministically recover its cryptographic keys and addresses. If the device is lost, damaged, or destroyed, a correctly recorded seed phrase can restore access in a compatible wallet.

If someone gets the seed phrase for a standard wallet, they can restore that wallet without knowing the PIN for your Keystone. That is why a seed phrase should never be photographed or stored on an internet-connected device or service.

1. When you create a new standard wallet, Keystone generates a 24-word seed phrase. Write the words down in exactly the order shown on the device
2. Read the security warnings on the screen carefully. Keystone will remind you to make sure no one else can see the screen, there are no surveillance cameras aimed at it, and your phone is not pointed at the device
3. Keystone displays the words one at a time. Write each word by hand on the Secret Recovery Sheet as it appears. The words are numbered, so preserve the exact order
4. Check each word immediately after writing it down. A single wrong letter or a changed word order can prevent recovery. Pay extra attention to similar BIP39 words such as board/boat, wood/wool, and coin/coil
5. After all words are recorded, tap [Next]. Keystone will ask you to identify several randomly selected words from multiple choices to confirm that you copied the phrase correctly
6. Once the confirmation is complete, the wallet is created

Store the seed phrase securely

The included Secret Recovery Sheet is fine as an initial backup, but paper is vulnerable to fire, water, fading, and physical damage. For long-term storage, consider a metal seed phrase backup:

• Keystone Tablet Plus, Keystone’s own metal backup plate
• Cryptosteel Capsule, a popular steel option
• Billfodl, Blockplate, and other alternatives available on the market

Practical backup guidelines:

• The paper Secret Recovery Sheet works as an initial backup if it is kept dry, stored separately from the device, and protected from unauthorized access
• For long-term storage or for an amount whose loss would materially affect you, a metal backup is the safer option. Every complete copy of the seed phrase provides full access to the funds, so keep additional copies only in secure locations you control
• If you want to distribute recovery across several locations without keeping a complete seed phrase in each one, consider Shamir Backup. Make sure you understand the recovery threshold and how the individual shares must be stored before using it

Step 6. Set up fingerprint unlock (optional)

The fingerprint sensor is located on the back of Keystone 3 Pro below the camera. According to Keystone’s documentation, you can enroll up to three fingerprints and choose what each fingerprint can be used for.

Add a fingerprint

1. On the home screen, tap [···] in the top-right corner
2. Open [Device Settings] > [Wallet Settings] > [Fingerprints & Password] > [Fingerprint Settings]
3. Enter your PIN to access the security settings
4. Place your finger on the rear sensor. The device will vibrate and ask you to touch the sensor repeatedly from slightly different angles so it can capture the fingerprint completely
5. When enrollment is complete, Keystone will display a success message
6. Give the fingerprint a name, such as Right thumb, so you can tell multiple enrolled fingers apart later

Keystone’s documentation uses two slightly different labels for this section: [Fingerprints & Password] on the fingerprint page and [Fingerprint & Passcode] on the passcode-reset page. They refer to the same area under [Wallet Settings], so use the menu position as your reference if the wording differs.

Choose where the fingerprint can be used

After enrollment, Keystone opens Fingerprint Applicable Scenarios, where you can choose what the fingerprint is allowed to do:

• Device Unlock — unlock the device instead of entering the PIN
• Transaction Signing — approve transactions with a fingerprint instead of the PIN

We recommend leaving Transaction Signing disabled for fingerprint authentication. If you want to use biometrics, use it for device unlock and keep transaction signing behind the PIN. You can also choose not to use biometrics at all.

Step 7. Connect a software wallet

Keystone stores the private keys and signs transactions. To view balances, receive and send crypto, and use DeFi or NFTs, you pair it with a compatible software wallet. This guide uses QR-based connections; some Keystone 3 Pro integrations also support USB.

You have two main options: Keystone’s own Nexus app or third-party wallets such as OKX Wallet, MetaMask, and Rabby. We will start with Nexus.

Examples of compatible software wallets

For the current list of supported wallets, networks, and assets, see Keystone’s official compatibility list. Keystone updates this page as new integrations are added, so check it before relying on support for a specific asset or network.

Option 1: Keystone Nexus (official app)

Keystone Nexus is the official mobile companion app for Keystone 3 Pro on iOS and Android. It displays balances, prepares asset operations, and sends transaction data to Keystone for review and signing. The private keys remain on the hardware wallet.

Why start with Nexus?

• Simple pairing. Install Nexus, scan the QR code shown by Keystone, and choose the assets you want to manage.
• Multiple networks in one app. Nexus supports Bitcoin, Ethereum, Solana, TRON, Cardano, Zcash, and other supported assets.
• Built-in Swap. Swaps can be initiated directly in Nexus; asset and regional availability depends on the provider.
• First-party support. If the issue is specific to Nexus, you can contact Keystone directly.

How to connect Keystone to Nexus

1. Download Keystone Nexus from the App Store or Google Play
2. On Keystone, tap [···] in the top-right corner of the home screen
3. Choose [Keystone Nexus]. Keystone will display a QR code for pairing
4. Open Nexus on your phone and tap [Start protecting your assets] > [Scan to connect]
5. Allow camera access and point the phone at the QR code on Keystone
6. Choose the assets you want to manage

Nexus receives the public data required to derive/display addresses and balances and then shows those assets on its home screen. Your private keys remain on Keystone: Nexus prepares transactions, while signing happens on the hardware wallet.

How to send a transaction through Nexus

1. In Nexus, choose the asset, tap [Send], and enter the recipient address and amount
2. Continue to confirmation. Nexus will display a QR code containing the unsigned transaction
3. On Keystone, tap the scanner icon and point the camera at the QR code in Nexus
4. Review the transaction details on Keystone and confirm with your PIN or, if you intentionally enabled Transaction Signing, a fingerprint. Keystone will then display a new QR code containing the signed transaction
5. In Nexus, scan the QR code from Keystone with your phone. Nexus will broadcast the transaction to the network

Option 2: third-party wallets

Third-party wallets are useful when you need a specific DeFi protocol, NFT marketplace, or network feature. Compatible options include OKX Wallet, MetaMask, and Rabby. Below we use the mobile version of OKX Wallet as a practical example. Other wallets may use different menu labels, so check Keystone’s dedicated instructions for the app you choose.

How to connect OKX Wallet

The mobile version is used here as the example. Pairing is done with a QR code, and the private keys remain on Keystone.

1. On Keystone, open the home screen and tap [···] in the top-right corner
2. Choose [Connect Software Wallet] > [OKX Wallet]. Keystone will display a QR code
3. On your phone, open OKX Wallet and tap [Wallet] at the top of the screen
4. Choose [I already have one] > [Hardware Wallet] > [Keystone]
5. Tap [Scan to connect] > [Connect now] and allow camera access
6. Point the phone camera at the QR code on Keystone
7. Select the account you want to use. After pairing, compare the address shown in OKX Wallet with the address on Keystone. They should match exactly

After updating the firmware in Step 4, you do not need to separately check an older minimum-version requirement for OKX Wallet. Install OKX Wallet only from the App Store, Google Play, or the official OKX website.

Step 8. Receive cryptocurrency

Once a software wallet is connected, you can receive funds. Wallet addresses are deterministically derived from your keys, and you should verify the address on Keystone before using it.

How to get a receiving address

1. Unlock Keystone with your PIN or fingerprint
2. On the home screen, choose the asset you want to receive. Keystone displays major coins directly; tokens use the address format of their underlying network. For example, USDT on Ethereum is received at the same ETH account address
3. Tap [Receive]. Keystone will show the full address and a QR code
4. Compare that address with the one shown by the software wallet for the same account. They must match character for character
5. Share the address with the sender. They can scan the QR code directly from the Keystone screen, or you can copy the text address from the software wallet after verifying it against the hardware wallet

EVM addresses and networks

A single EVM address beginning with 0x can be used across multiple EVM-compatible networks, including Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, and Avalanche C-Chain. The same address may appear on several networks, but balances and tokens on those networks remain separate.

Your funds exist on the network where they were sent. If someone sends you USDT on Polygon while your software wallet is currently showing Ethereum, you need to switch to Polygon to see that balance.

Bitcoin uses separate address formats: bc1q… for Native SegWit, bc1p… for Taproot, addresses beginning with 3… for P2SH/Nested SegWit, and addresses beginning with 1… for Legacy. You cannot send BTC to an ETH address or ETH to a Bitcoin address.

Step 9. Send your first transaction

In this guide, sending is handled with QR codes: the software wallet builds the transaction, Keystone reviews and signs it, and the signed transaction is returned to the software wallet for broadcasting. Your private keys never leave Keystone.

The complete sending flow

1. In the software wallet, choose the asset and tap [Send]
2. Enter the recipient address and amount, select the network, and review the fee
3. Continue to confirmation. The software wallet will build the transaction and display a QR code for signing
4. On Keystone, open the home screen and tap the scanner icon in the top-right corner
5. Point Keystone’s camera at the transaction QR code. If the data is split across an animated QR sequence, keep the camera steady until Keystone has read the entire sequence
6. Keystone will show the transaction details: recipient address, amount, network, and fee. Compare the address on the device with the address you intended to use, and review the amount, network, and fee. Do not verify only the first or last few characters
7. If everything is correct, tap [Sign] and confirm with your PIN or, if you deliberately enabled Transaction Signing, your fingerprint
8. Keystone signs the transaction internally and displays a new QR code containing the signed transaction
9. Return to the software wallet and open its signed-transaction scanner
10. Point your phone camera at the QR code on Keystone. The wallet will read the signature and broadcast the transaction

After broadcasting, track the transaction status in your software wallet or a blockchain explorer.

What to check when signing smart-contract transactions

A simple transfer makes the recipient and amount easy to inspect. In DeFi, however, a transaction may call a smart contract for actions such as swap, staking, or approve. Keystone decodes supported transactions so it can show human-readable signing details instead of only raw transaction data.

Before signing, check:

• Method name. Transfer, approve, swap, stake, or another action should match what you just initiated
• Approve parameters. If the allowance is shown as Unlimited or as an unexpectedly large amount, stop and verify exactly what permission you are granting
• Contract address. Make sure you are interacting with the legitimate protocol. Attackers can substitute look-alike addresses
• Network fee. If the gas cost is suspiciously high, the transaction may not be what you expected to approve

What to do after setup

A few practices are worth keeping as ongoing habits:

• Check for firmware updates regularly on the official Keystone firmware page and read the release notes before installing. Do not postpone critical security updates without a reason.
• Verify your backup periodically with the built-in [Seed Phrase Check] function: [···] > [Device Settings] > [Wallet Settings] > [Seed Phrase Check]. This lets you verify the phrase you recorded without wiping the main device.
• If the backup needs to withstand fire, water, or long-term storage, use a metal backup instead of paper.
• Never enter the seed phrase on websites, in chats, notes, or ordinary online services. For recovery, use a trusted compatible hardware wallet or another deliberately chosen offline method. Keystone Support will never ask for your seed phrase.
• Separate use cases. Funds used for everyday transactions are better kept separate from long-term holdings and wallets used for DeFi interactions.
• Store the PIN and seed phrase separately in different physical locations. Access to one should not automatically provide access to the other.
• Review token approvals periodically using Revoke.cash or Etherscan Token Approval Checker, and revoke permissions you no longer need.

Troubleshooting common problems

USDT is in the wallet, but you cannot send it

Check the balance of the network’s native coin. USDT transfer fees are not paid in USDT; they are paid in the blockchain’s native asset, such as ETH on Ethereum, TRX on Tron, or BNB on BNB Chain. If that balance is zero, add enough of the native coin to cover the network fee and try again.

For more detail on choosing a network and keeping the correct native coin for fees, see our Lwallet guide to using USDT with a hardware wallet.

The device will not turn on

Connect the device to power and let it charge before trying again. If the included cable does not work, test another known-good USB-C cable and power adapter. If that does not help, contact the seller or Keystone Support.

Firmware will not update from microSD

Check these items in order:

• Card format: FAT32, not exFAT or NTFS.
• Filename: exactly keystone3.bin, without suffixes such as keystone3(1).bin.
• Location: keystone3.bin must be in the root directory of the card, not inside a folder.
• The card should contain only one firmware file named keystone3.bin.
• If everything above is correct and the update still does not start, try another microSD card. Keystone recommends 32 GB or 64 GB cards.

Keystone will not scan a QR code

Increase the screen brightness and hold Keystone so the entire QR code fits inside the camera frame. Adjust the distance or angle slightly if necessary, and wipe the rear camera lens with a soft, dry cloth. If the QR code is animated, keep the camera steady until the device reads the full sequence.

The software wallet cannot find Keystone

Update the app to the latest version. On Keystone, open [···] > [Connect Software Wallet] again, choose the required wallet, and repeat the pairing process in the app. Make sure camera permission is enabled and scan a freshly generated QR code from Keystone.

You forgot the PIN

Resetting a forgotten passcode requires seed phrase verification. Keystone’s official documentation gives the path [···] > [Device Settings] > [Wallet Settings] > [Fingerprint & Passcode] > [Reset Passcode] > [Forgot Passcode]. The exact on-screen location can vary with device state and firmware version, so use the [Forgot Passcode] label and the prompts shown by the device as your guide.

The transaction QR code is too large for Keystone

Complex transactions contain more data, so the QR may be split across multiple animated frames. This is normal: keep Keystone steady and wait until it reads the full sequence. If scanning does not start, increase the phone screen brightness and make sure Keystone’s camera lens is clean.

The device appears stuck during a firmware update

Do not power the device off during an update. If the progress indicator does not change for an unusually long time, compare your steps with Keystone’s official firmware update instructions and contact Keystone Support. Do not interrupt the update at random.

Where to buy Keystone 3 Pro

A hardware wallet is best purchased directly from the manufacturer or from an authorized reseller. This reduces the risk of receiving a device of unknown origin that may already have been opened or tampered with before sale.

You can order Keystone 3 Pro from Keystone’s official store or buy it from us at Lwallet. We are also listed in Keystone’s official authorized reseller directory for Ukraine.

We supply genuine Keystone devices in Ukraine and can help with setup and everyday use.

Setup complete: what’s next?

Once your Keystone 3 Pro setup is complete, make sure you have:

• verified the device with Device Verification;
• updated the firmware to the current release;
• created a PIN and a new seed phrase directly on Keystone;
• recorded the seed phrase offline and checked the word order;
• set up fingerprint unlock if you want to use it;
• connected Nexus or another compatible software wallet;
• verified addresses and transaction details on Keystone’s own screen before signing.

Features worth exploring later:

• Passphrase: an additional secret passphrase on top of the standard seed phrase that derives a separate wallet and is not stored on Keystone
• Shamir Backup with SLIP-39: a separate wallet-creation flow that uses multiple mnemonic shares and a defined recovery threshold
• A second and third seed phrase on the same device
• Sparrow Wallet integration for more advanced Bitcoin workflows
• A metal backup instead of paper