Keep shielded ZEC in cold storage: pair a Keystone hardware wallet with the Zodl app (formerly Zashi, rebranded in February 2026) and sign transactions by QR code.
TL;DR
Keystone 3 Pro (or Keystone 3) with the Cypherpunk firmware works as an air-gapped signer for Zodl, so shielded ZEC can stay in cold storage.
Before you start: battery above 20%, the USB cable (or a FAT32 MicroSD card) for firmware updates, and the Zodl app on your phone.
Verify the device on Keystone's website first. This checks that it was not tampered with in transit.
Create the wallet on the Keystone and write down the 24-word seed phrase offline. It never goes into Zodl.
Connect: on Keystone tap "..." > Connect Software Wallet > Zodl, then in Zodl tap Connect Hardware Wallet and scan the QR.
Zodl builds each transaction; you approve and sign it on the Keystone screen by scanning QR codes back and forth.
Core Explanation
A hardware wallet keeps your spending keys on a separate device that never touches the internet. Keystone is air-gapped: it talks to your phone only through QR codes, not Bluetooth or USB.
In this setup Zodl is the "watch" side. It syncs with the Zcash network, shows your shielded balance and prepares transactions. The Keystone holds the seed phrase and signs. A compromised phone can see your balance, but it cannot move funds without approval on the Keystone.
The steps below cover preparing the device, verifying it, updating the firmware, creating the wallet and connecting it to Zodl.
This integration marks a significant evolution in Zcash usability by enabling cold storage of shielded ZEC. The Zcash community has faced setbacks with other hardware wallet platforms in the past, but Keystone emerged as a collaborative partner willing to push boundaries and innovate alongside the Electric Coin Company. The Keystone team received a ZCG grant to fuel their side of the work.
Device Verification (via QR): Device Verification is crucial to detect potential contamination during transportation, prevent supply chain attacks, and ensure the safety of installed firmware.
Visit the Device Verification page on the Keystone website.
Click on Scan QR Code on the official website.
Use your Keystone camera to scan the QR code shown on the website.
A verification code will appear on your Keystone screen.
Enter this code on the website to complete the verification process.
Firmware Update:
Update via MicroSD card
Make sure your Keystone wallet has at least 20% battery charge.
Insert the SD card into your computer and format it as FAT32.
Download the latest Cypherpunk firmware version from the Keystone Firmware Update page and save the keystone3.bin file to the root of your MicroSD card.
Place the SD card with the firmware into your Keystone wallet.
Access the "Upgrade" option on your Keystone wallet, then follow the on-screen instructions to initiate the update process.
Update via USB Cable
If your firmware version is below 1.0.4, you will need to perform the initial update using a MicroSD card before you can proceed with USB updates.
Ensure your Keystone wallet has at least 20% battery charge.
Tap on via USB and use the USB cable to connect your Keystone wallet to your computer. Tap [Approve] to grant your Keystone wallet USB access, as it might otherwise only allow charging.
