Keystone 3 Pro vs Trezor Model One

Keystone detected unauthorized access to its official website on 20 October 2026. In its update of 26 October the company said the attacker used a vulnerability in a third-party data monitoring tool on the site to escalate privileges. 25,964 buyer records from 2024–2026 still held personal data — names, contact details, shipping addresses and order details — and 12,873 unpaid checkout records are counted as well. Keystone acknowledged that its promise to erase shipping data within 180 days had not been fully kept; it now keeps that data for at most 90 days.

The attacker also obtained the key Keystone’s website uses to check that a device is genuine. The key is written into each device at the factory and cannot be changed, so Keystone will scrap the 18,835 devices in stock that carry it and give newly made devices a new key. Website orders are on hold until those devices are ready. According to Keystone, recovery phrases, private keys and payment details were not exposed, and owners are not asked to move funds because of this incident.

Keystone’s advice:

• A device delivered before 20 October 2026 that passes the authenticity check is genuine.
• For a device received after 20 October with the old key, Keystone cannot fully rule out a counterfeit even if the check passes: contact Keystone support for additional verification before using it.
• Keystone will not ask anyone to return a device. Treat “recall”, refund, migration or wallet-verification messages as scams, and never enter a recovery phrase into a device you did not order yourself.

The breach concerns customer data and the online authenticity check, not how the device generates or protects keys, so it does not change our ratings.

On 28 October 2026 Trezor received a report from a buyer in Indonesia of an extra circuit board inside a Trezor Safe 5 bought in August 2026 from CryptoBilis, the same Southeast Asian reseller whose Ledger devices carried hardware implants. According to the report, the board sits between the main board and the screen, reads what the screen shows, including the recovery phrase, and sends it out over a mobile network. Trezor has not yet examined the device, calls the report credible and is having the unit sent to its lab.

Trezor says it has no reports involving any other reseller and no evidence that any customer has lost funds; the person who reported the implant had already moved their funds. Trezor removed CryptoBilis from its authorized resellers on 9 October 2026.

Trezor’s advice applies to every Trezor model bought from CryptoBilis from March 2026 onwards:

• If the device is not set up yet, do not set it up and never enter an existing recovery phrase on it.
• If you already use it, move your funds as soon as possible to a new wallet with a newly generated recovery phrase. Restoring the old phrase on another device does not help.
• Keep the device and contact Trezor Support: affected buyers can get a new device or a voucher. Do not open it; Trezor says weighing it is not a reliable test.

The report concerns how one device reached a buyer, not the device design, so it does not change our ratings. We will update this notice when Trezor publishes the result of its examination.