USB SDK flaw allowed code execution on an unlocked Keystone 3 Pro
Who is affected
Someone holding a Keystone 3 Pro on firmware older than 2.4.0, knowing its PIN and approving a USB connection on it could run code on its microcontroller; ANZEN says this led to the recovery phrase. Keystone reports no exploitation.
What happened
On 3 July 2026 Keystone and OneKey’s ANZEN research team published a joint security update on a flaw in the USB SDK that the maker of the Keystone 3 Pro’s microcontroller (MCU) supplies and Keystone integrated into its firmware. ANZEN found it during a joint security audit in March 2026. Keystone released firmware 2.4.0 on 1 April 2026 and delayed publication so that users had time to update; its release notes for 2.4.0 list only “enhanced firmware upgrade security mechanisms”.
Keystone states that the SDK did not sufficiently validate memory access during USB initialisation, causing out-of-bounds access that could let an attacker run unauthorised code on the MCU, “creating an additional attack path that could potentially impact users’ assets”. It says it hardened its firmware and reported the issue to the MCU vendor. ANZEN’s write-up describes the bug as a host-supplied length checked against a fixed 8-byte buffer and states that the team went on to extract the BIP39 recovery phrase; Keystone’s statement does not mention seed extraction. ANZEN presented the research as an on-demand briefing at Black Hat USA 2026.
According to Keystone, exploitation required all of the following: physical possession of the device, knowledge of its PIN, unlocking it, connecting it by USB to an attacker-controlled computer and approving that connection on the device, and running specially crafted code. Keystone states that the flaw did not bypass these basic protections and that it has received no reports and found no evidence of exploitation.
What Keystone advises:
- Update to the latest firmware; devices on 2.4.0 or later are not affected.
- Keep the device physically secure and never disclose its PIN.
- Where possible, sign with the air-gapped QR-code workflow instead of USB, and reject unexpected USB authorisation requests.
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionA security audit is an independent review of blockchain code or smart contracts by experts to identify vulnerabilities and ensure robustness.
Read full definitionBIP39 is a standard for generating mnemonic seed phrases that are used to create deterministic wallets and securely back up cryptocurrency private keys.
Read full definitionA mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionPIN Protection is a security feature that requires a personal identification number (PIN) to access a cryptocurrency wallet or device, preventing unauthorized access.
Read full definitionAn air-gapped wallet is a cryptocurrency wallet that remains completely offline, disconnected from the internet, to prevent exposure to online threats and attacks.
Read full definitionSources
Independent reporting and research this entry was checked against.
- Keystone — Joint Security Update from Keystone and OneKey Anzen: USB SDK Security Issue Fixed (3 Jul 2026)
- OneKey ANZEN — How We Compromised Keystone via a USB Vulnerability (Jul 2026)
- Black Hat USA 2026 — From 8 Bytes to Full Compromise: AI-Assisted Exploitation of a Widespread USB Flaw in a Multi-SE Hardware Wallet (on-demand briefing)
- GitHub — KeystoneHQ/keystone3-firmware release 2.4.0 (1 Apr 2026)
Learn more
Guides on protecting yourself against this type of incident (Firmware vulnerability) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideIs a Hardware Wallet Really Safe?
Hardware wallets are the safest option for most people — but you can still make mistakes. Here's what to know.
Read GuideFirmware
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Bootloader
A bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.
Firmware Update
Firmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.
Cite this entry
WalletInsights. “USB SDK flaw allowed code execution on an unlocked Keystone 3 Pro”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/keystone-3-pro-usb-sdk-code-execution-2026/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.