Keystone 3 Pro vs OneKey Neo

Keystone detected unauthorized access to its official website on 20 October 2026. In its update of 26 October the company said the attacker used a vulnerability in a third-party data monitoring tool on the site to escalate privileges. 25,964 buyer records from 2024–2026 still held personal data — names, contact details, shipping addresses and order details — and 12,873 unpaid checkout records are counted as well. Keystone acknowledged that its promise to erase shipping data within 180 days had not been fully kept; it now keeps that data for at most 90 days.

The attacker also obtained the key Keystone’s website uses to check that a device is genuine. The key is written into each device at the factory and cannot be changed, so Keystone will scrap the 18,835 devices in stock that carry it and give newly made devices a new key. Website orders are on hold until those devices are ready. According to Keystone, recovery phrases, private keys and payment details were not exposed, and owners are not asked to move funds because of this incident.

Keystone’s advice:

• A device delivered before 20 October 2026 that passes the authenticity check is genuine.
• For a device received after 20 October with the old key, Keystone cannot fully rule out a counterfeit even if the check passes: contact Keystone support for additional verification before using it.
• Keystone will not ask anyone to return a device. Treat “recall”, refund, migration or wallet-verification messages as scams, and never enter a recovery phrase into a device you did not order yourself.

The breach concerns customer data and the online authenticity check, not how the device generates or protects keys, so it does not change our ratings.

After Ledger found hardware implants in Ledger devices sold by the reseller CryptoBilis, OneKey ended CryptoBilis’s authorization, paused new resellers and began reviewing existing ones. OneKey says no OneKey user has reported losing funds and does not report finding a tampered OneKey device.

As a precaution, OneKey replaces for free any OneKey model bought from CryptoBilis between 1 March and 12 October 2026, activated or not, with proof of purchase. Apply through OneKey support by 31 December 2026; the old device does not need to be returned.

OneKey’s advice: do not activate an unused CryptoBilis unit. If a device from CryptoBilis already holds funds, move them now to a wallet with a newly generated recovery phrase rather than waiting for the replacement.

This concerns one reseller, not the device design, so it does not change our ratings.