How to Secure Your Keystone with COLDCARD

Use Coldcard as the offline source of a separate Keystone wallet by deriving a BIP-85 child mnemonic and entering that child on Keystone. Never import your Coldcard master seed. The parent stays on Coldcard; Keystone receives one dedicated multi-asset child.

This gives stablecoins and other supported networks a recovery root that is compartmentalized from the Coldcard wallet. It does not make Keystone Bitcoin-only or remove the risks of broader firmware, token parsing, smart contracts, and companion apps.

Verified scope: These steps target Keystone 3 Pro. The official firmware page listed version 2.5.0 on July 10, 2026, and current English import and Seed Phrase Check labels were verified against Keystone's official firmware source.

Why keep a multi-coin signer?

Coldcard is deliberately Bitcoin-only. That focus reduces scope, but many users still need assets Coldcard will not support: dollar stablecoins, another network used for work or payments, or a specific software-wallet integration.

Keystone 3 Pro's current multi-coin firmware advertises more than 5,500 assets and more than 45 software-wallet integrations. Its compatibility list includes USDT and USDC through several companions. Those capabilities are a valid reason to keep the device despite a wider attack and recovery surface.

The security goal is separation, not denial. A dedicated child keeps the Coldcard master out of the multi-coin device. If Keystone, one companion, or the child backup is compromised, the Coldcard wallet and unrelated siblings are not revealed through that child.

Every asset on the Keystone child still shares one seed. If the child is exposed, all chains and tokens derived from it must be treated as exposed.

Use a child seed, not the master

A BIP-39 seed can derive accounts on many networks. Reusing the Coldcard master in Keystone would therefore place the most valuable recovery root inside a broad multi-chain environment.

Use this hierarchy instead:

Coldcard parent
└── BIP-85: BIP-39 / English / 24 words / index N
    └── Keystone wallet
        ├── Bitcoin, if deliberately used
        ├── Ethereum or other networks
        └── Stablecoin token accounts

The same Coldcard parent context and index reproduce the 24 words. A compromised child does not reveal the parent through the BIP-85 construction. A compromised parent can recreate this Keystone child and every sibling.

Coldcard is the seed source, not a co-signer. Keystone can authorize transactions from the child without Coldcard after import.

Verify the device and firmware

Perform Keystone Device Verification before entering any child words. Keystone's official tool asks the device to scan a QR code, then asks you to enter a verification code on the official page.

If verification fails, stop. Keystone explicitly says not to enter a seed into a device that fails verification.

Choose the firmware that matches the role:

Multi-Coin for stablecoins and the broad asset list;
Cypherpunk for the smaller published privacy-chain set;
Bitcoin-Only only when the device will not be used for unsupported assets.

Verify the firmware download and checksum through official channels. Device verification confirms an important starting condition; it does not prove that every future app, token contract, or transaction is safe.

Before you start

Use a new or empty Keystone wallet slot. Do not delete or replace a funded wallet until its backup and recovery metadata have been checked and its assets can be moved safely.

You need:

a Coldcard Q or Mk5 with the intended parent;
a verified backup of that parent;
a verified Keystone 3 Pro with the intended firmware;
official companion apps for the networks you actually need;
a private workspace without cameras or observers;
paper for BIP-85, chain, account, and derivation metadata;
small amounts of each required native fee asset for testing.

Avoid deriving under an unintended Coldcard passphrase or temporary seed. Recovery requires the same parent context.

Derive and import the Keystone seed

1. Confirm the Coldcard parent

Sign in to the Coldcard wallet that will act as the parent. Confirm its backup and that no unintended passphrase or temporary seed is active.

2. Open BIP-85

Use the path for your model:

Mk5 and Mk4: Advanced/Tools > Derive Seed B85
Q: Advanced/Tools > Derive Seeds (BIP-85)

Choose BIP-39, English, and 24 words.

3. Assign an index

Choose an unused index from 0 through 9999 and record:

Purpose: Keystone wallet
Standard: BIP-85
Application: BIP-39
Language: English
Words: 24
Index: ____
Keystone slot/name: ____
Firmware type: Multi-Coin / Cypherpunk / Bitcoin-Only

The index is recovery metadata. It is not a secret factor that can compensate for a stolen parent.

4. Display the child on Coldcard

Read the words from the Coldcard screen. Do not save the child with MicroSD, Virtual Disk, NFC, QR, or USB keyboard emulation for this workflow. Keep both device screens out of view of cameras.

5. Import it on Keystone

On a new Keystone 3 Pro wallet:

Choose Import Wallet.
Set and confirm the PIN or password requested by the device.
Name the wallet so its role is unambiguous.
At Choose Import Method, select Single Secret Phrase.
Select 24 Words.
At Import Your Seed, enter the child words on the Keystone touchscreen.
Complete the import and return to the wallet overview.

Do not type the child into a companion app, browser, phone, or computer. The only destination is Keystone.

Verify the seed before funding

1. Reproduce the child on Coldcard

Exit the first BIP-85 display. Return to the same parent context and derive BIP-39, English, 24 words, at the recorded index.

2. Run Seed Phrase Check

On Keystone, open Device Settings > Wallet Settings > Seed Phrase Check. Choose Standard Seed Phrase, select 24 words, and enter the newly displayed child.

The device should report Verification Successful. If it reports a failure, do not fund any account. Recheck parent context, language, word count, index, and word order.

If you later add a Keystone passphrase, remember that it creates a separate wallet. Keystone's current source instructs users to leave the passphrase wallet before running the standard seed check.

3. Pair only the companions you need

Install official companion software from verified sources. Pair Keystone with the correct companion and network, then add only the required accounts.

A broad compatibility list is not a reason to enable every integration. Each extra app, chain parser, and smart-contract interface adds code and operational complexity.

4. Verify addresses and send tests

For every network you will fund:

Generate a receive address in the companion.
Verify the address and account details on Keystone.
Send a small test amount on that exact network.
Confirm the balance and a small outbound transaction if the recovery plan depends on spending.
Keep enough of the native network asset to pay future fees.

Do not assume that a successful Ethereum test proves a Tron, Solana, Bitcoin, or other account is configured correctly.

Document cross-chain recovery

The 24 words recreate deterministic keys. They do not recreate your memory of which chains, tokens, accounts, paths, and companions you used.

Keep an offline recovery inventory for every funded asset:

Keystone wallet name/slot: ________
Wallet fingerprint: ________
Asset and ticker: ________
Network: ________
Token contract or asset identifier: ________
Companion wallet: ________
Account number: ________
Derivation path/address type: ________
Verified receive address: ________
Native fee asset: ________

This is especially important for stablecoins. “USDT” or “USDC” is not enough because the same ticker may exist on multiple networks. Record the exact network and token identifier.

Non-default derivation paths require special care. Keystone's own migration guidance warns that devices can use different paths for the same asset. A correct seed with the wrong path can produce a valid but apparently empty account.

Store this inventory separately from the child words. It is privacy-sensitive but normally not sufficient to spend without the seed.

Use Keystone's three wallets carefully

Keystone 3 Pro supports three seed-based wallets. That can separate a stablecoin operating wallet, another non-Bitcoin role, and a decoy or test wallet.

Assign a different BIP-85 index to each independent single-sig role and give each a clear name and metadata record. Do not load the same child into multiple slots and assume they are independent.

The three children still descend from one Coldcard parent. Parent compromise reaches all three. If you need independence from the parent itself, generate that wallet from a different root.

Do not use sibling children as separate cosigners in one multisig wallet. The common parent would undermine the quorum's failure separation.

Know the limits

Multi-coin scope remains broad

Coldcard seed provisioning does not shrink Keystone's firmware, chain, token, smart-contract, and companion surface. Keep firmware current, enable only necessary integrations, and verify every transaction on the Keystone display.

All assets on one child fail together

A stolen child mnemonic can expose every account derived from it across supported networks. BIP-85 protects the parent from the child; it does not isolate sibling accounts inside that child.

Stablecoins add non-key risks

Hardware protects signing keys. It does not remove issuer, redemption, freeze, smart-contract, bridge, liquidity, or network risks. Those are separate from seed custody.

The parent becomes more valuable

The Coldcard parent backup may recover several device wallets. Store it for the combined value and privacy of every child, and document any passphrase context required to reproduce them.

Native Keystone generation is still valid

Keystone can generate a 24-word seed and supports dice entropy. The BIP-85 design is useful when a deliberate Coldcard recovery root is worth the concentrated parent risk and metadata burden.

Sources and verification

Verified on July 10, 2026. Recheck Keystone firmware, source labels, supported assets, and companion compatibility before publication.

How to Store a Seed Phrase

Plan physical storage for a child backup that can authorize several networks.

Read article

What Is a Bitcoin Passphrase?

Learn how a passphrase changes wallet derivation and recovery requirements.