Cryptonaut Bob 👑🦁

Dear Keystone fam, We know this has been a stressful week, and many of you have questions. Here are answers to the ones we’re hearing most. → I bought my device in 2024/2025/2026. Am I affected? If you placed an order from 2024 to 2026, your shipping data may have been exposed. We’re building a page where you can check whether you’re affected, and we’ll share it here as soon as it’s live. → The authentication key was exposed. How can I verify a device delivered before Oct 20? Our device verification page still runs on the old authentication key, so you can still use it to verify an unopened Keystone. The attacker has that key now, but it doesn’t affect devices that were already delivered before Oct 20. → I already use my Keystone. Can I keep using it? Yes. If you received it before Oct 20, verify it on our website and keep using it as normal. → I received my device on/after Oct 20. What should I do? With the key exposed, attackers could build a fake device with the real key inside, making it look genuine. Contact our support team right away at [email protected], and they’ll walk you through the next steps. → My order is in transit. What should I do? Refuse the package when it arrives and email us at [email protected]. Our support team will help you from there. → Is it safe to place a new order on your website? Yes. Because of the key leak, we’ve set aside all existing Keystone 3 Pro inventory to be destroyed. Any order you place now is a pre-order from a fresh batch with new authentication keys, expected to arrive in 4 to 6 weeks. If you’re OK with the wait, go ahead and order. → Is it still safe to update my Keystone’s firmware? Yes. Your Keystone only installs firmware signed by our team. The key that leaked is our web authentication key, which is completely separate from our firmware signing key. Firmware updates are safe, so you can update and keep using your device as normal. ⚠️ Remember, scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or “fixes” for your order or address. None of it is from us. We will never ask for your recovery phrase or private keys. NEVER share them with anyone, and NEVER enter your recovery phrase into a device you didn’t order. Don’t click links in messages you weren’t expecting. Type keyst.one into your browser yourself. Need help? Reach us directly here on X or at [email protected] Once again, we’re sorry we let this happen. We’re doing everything we can to make it right and to help every affected user through it. Still have questions, or think we missed something? Drop them in the replies, and we’ll help.