#Keystone tutorial. How to update firmware on Keystone 3 Pro?

How to update Keystone 3 Pro firmware: in every release, Keystone fixes vulnerabilities, patches bugs, and adds support for new networks and wallets. That is why keeping the firmware up to date is part of protecting your assets. It is not a cosmetic improvement.

The main rule before you start: first make sure you have a working backup of your seed phrase. The update itself does not erase your assets or touch your keys, but if the process is interrupted (the battery dies, the card is removed), you will be able to restore access only with the seed. No backup? Do not start.

The steps below are based on Keystone’s official documentation (guide.keyst.one and keyst.one/firmware) with the exact menu item names. The device interface may change slightly over time, so if a menu item looks different on your device, follow the logic of the step rather than the exact wording.

Before you start

Check your current firmware version

On the device, open the [···] menu in the upper-right corner of the home screen, then go to Device Settings → System Settings → About. You will see the current version there. Write it down: it determines whether you need an intermediate step through version 2.4.0 (covered separately below).

Choose the firmware type

Keystone 3 Pro has three separate firmware branches, and you update within the one you need:

• Multi-Coin (default): 5500+ assets and 45+ software wallets. This is the option for most users. If you are not sure what to choose, choose this branch.
• Cypherpunk: BTC, ZEC (Zcash), XMR (Monero), and privacy-focused networks. For users who care about privacy.
• Bitcoin-Only: Bitcoin only. Less code and a smaller attack surface. For users who hold BTC exclusively.

You can switch between branches: the device allows you to move from a lower version to a higher version of another type, and also update within the same version. In other words, switching from Multi-Coin to Bitcoin-Only and back is a normal operation. At the time of publication, all three branches have the same version: 2.4.6.

What you need

There are two update methods, and the items you need depend on which one you choose:

• microSD card: an air-gapped method with no connection to a computer. You need a card and a card reader.
• USB cable (WebUSB): a direct update from your computer browser.

For either method, the battery charge must be at least 40%.

How to update Keystone 3 Pro firmware with a microSD card

This is the air-gapped method: the device is never connected to a computer, and the firmware comes from the card. If maximum isolation matters to you, choose this method.

What you need: Keystone 3 Pro, a microSD card with a card reader (Keystone recommends 32 or 64 GB), and a computer.

1. Check the battery: at least 40%.
2. Format the card as FAT32 (capacity up to 512 GB). If you do not know how, Keystone’s documentation has a separate guide for formatting a microSD card as FAT32.
3. Download the firmware. Go to the official page keyst.one/firmware, choose the firmware type you need (Multi-Coin / Cypherpunk / Bitcoin-Only), and download the keystone3.bin file. Copy it to the root of the card.
4. Check the card contents. It should contain only keystone3.bin and nothing else. If your browser saved the file as keystone3(1).bin, rename it exactly to keystone3.bin. The device will not accept another file name.
5. Insert the card into Keystone.
6. Start the update: [···] → Device Settings → System Settings → About → Firmware Update → Via MicroSD Card. Confirm.

Check the checksum

Most users skip this step, but it confirms that the firmware file you downloaded has not been replaced. This feature works only for microSD updates and on firmware version 1.2.4 or later.

How it works: the device accepts only firmware signed with Keystone’s official private key, so a file from an unofficial source will not install. The checksum is an additional check that the file you downloaded matches the official file bit for bit.

1. After you insert the card with keystone3.bin, the screen will show an “Update Available” window. If it does not appear, go to the same update menu (About → Firmware Update → Via MicroSD Card) and press update.
2. In the window, press “Show Checksum”.
3. Wait a few seconds while the device calculates the sum (SHA256).
4. Compare the number on the Keystone screen with the one shown next to your firmware on keyst.one/firmware (the “Checksum (SHA256)” link).
5. If they match, the file is authentic and you can continue the update. If they do not match, do not install it; download the file again from the official website.

Method 2: via USB (WebUSB)

This is the simpler method: no card is needed, and the update runs directly from your computer browser. It works well if you do not need full air-gapped isolation specifically during the update step.

What you need: Keystone 3 Pro, a USB cable, and a computer.

1. If your current version is lower than 1.0.4, do the first update via microSD first (method 1). WebUSB was added in firmware 1.0.4, so older versions do not have it.
2. Check the battery: at least 40%.
3. Open keyst.one/firmware in a browser on your computer.
4. On the device: [···] → Device Settings → System Settings → About → Firmware Update → press [via USB]. Connect Keystone to the computer with the cable. When the device asks for USB access, press [Approve] (without this, it will only charge).
5. Follow the on-screen instructions on the update page.

Critical update 2.4.0: do not skip it

Here is how it looks in practice when you start the update:

• If the current version is lower than 2.0.0: choose [Firmware 2.4.0] on the left side of the screen, download it, and install it.
• If the current version is 2.0.0 or higher: choose [Firmware 2.4.0] on the right side, download it, and install it.

After installing 2.4.0, repeat the update process to move to the current version (2.4.6 at the time of publication). If your device is already on 2.4.0 or later, this step does not apply to you: update directly to the latest version.

FAQ

Can I skip firmware versions?

Yes. You can update directly to the latest version; installing intermediate releases is not required. The only exception is the critical security step through 2.4.0 for devices running an older version (see the block above).

Will I lose my assets after the update?

No. The new firmware is backward compatible: the wallets you connected before (MetaMask, OKX, Rabby, and others) and your assets will keep working as before. In new versions, Keystone usually adds support for new networks rather than removing old ones. You need a seed backup in case of a technical failure during the process, not because the update “erases” something.

The device does not see the card or does not accept the file

There are three common reasons. First: the card is not formatted as FAT32, so reformat it. Second: there are extra files on the card; leave only keystone3.bin. Third: the file name is wrong because browsers often save it as keystone3(1).bin; rename it exactly to keystone3.bin.

Can I switch between Multi-Coin, Cypherpunk, and Bitcoin-Only?

Yes, this is a normal operation. The device allows you to move from a lower version to a higher version of another type and update within the same version. You can install Bitcoin-Only and later return to Multi-Coin.

Is Keystone firmware open source?

Yes, the firmware code is fully open source and available on GitHub (github.com/KeystoneHQ/keystone3-firmware). A technically skilled user can read the code, build it independently, and compare it with the official release via SHA256. For most users, checking the checksum on the device is enough (method 1).

Have questions or do not have Keystone yet?

If something goes wrong during the update or you still have questions, contact support. You can buy the device both on the official Keystone website and from us at Lwallet.com.ua: local delivery across Ukraine, Ukrainian-language support, and no hassle with customs. Both options work, so choose the one that is more convenient for you.