To use shielded Zcash with a Keystone 3 Pro and the Zodl wallet, the Keystone must run Keystone's "Cypherpunk" firmware, and for the Ironwood pool it must run firmware v3.0.2 or later. Zodl prepares the transactions and the Keystone signs them, with QR codes passing between the two. This guide follows the official pages and says where we could not confirm something.
Status as of October 12, 2026
Everything below comes from Keystone's firmware page (read October 12, 2026) and five Zodl Help Desk articles dated April to August 2026; we did not test a device for this guide. Three points are not confirmed: which pool a new Keystone wallet's Shield button targets after Ironwood, whether any Multi-Coin firmware handles shielded ZEC (Zodl says only Cypherpunk does, in an article dated April 2, 2026; Keystone's page describes only transparent ZEC addresses for Multi-Coin), and the scope of the Keystone security audit. Firmware numbers change, so check keyst.one/firmware before you act.
What you need
| Item | What the official pages say |
|---|---|
| Device | Keystone 3 Pro, the only model named in Zodl's articles and on Keystone's firmware page |
| Firmware | The Cypherpunk edition. Zodl: "Only this release supports shielded Zcash." For Ironwood: v3.0.2 or later |
| Zodl | Zodl's Keystone migration walkthrough (updated August 8, 2026) lists Zodl v3.9.0 or later as the prerequisite |
| Backup | Your Keystone recovery phrase, written down before any firmware upgrade (Keystone advises this) |
The Zodl guide covers the app itself, and our wallet comparison explains why Keystone and Zodl are paired. Ledger works differently, with Ledger's own app on a computer; see Zcash on Ledger.
The Cypherpunk firmware
Keystone publishes separate firmware editions. On October 12, 2026, its firmware page listed Multi-Coin 3.1.2 (dated October 10, 2026), Cypherpunk 3.0.4-CYPHERPUNK (dated August 12, 2026) and Bitcoin-only 3.1.0-BTC (dated September 17, 2026). It describes the Cypherpunk edition as covering Bitcoin, Zcash and Monero. Zodl's Keystone article says shielded Zcash works only with that edition.
Keystone's own release notes show how the Zcash support grew. These are the Zcash-related entries, in Keystone's wording, newest first (only 3.0.4 carries a date on the page):
| Cypherpunk release | Zcash note |
|---|---|
| 3.0.4 (August 12, 2026) | Optimized transaction parsing (no Zcash-specific note) |
| 3.0.2 | "Intended solely to support the Zcash Ironwood upgrade" and "only compatible with the Cypherpunk edition"; added batch PCZT signing for Zcash |
| 2.5.0 | Supported managing ZEC via Vizor |
| 2.4.4 | Added support for Zcash using SLIP39 33-word Shamir Backup |
| 2.4.2 | Improved BTC and ZEC transaction parsing |
| 2.3.10 | Fixed the signing issue for shielding transparent ZEC transactions |
| 2.2.6 | Support managing ZEC assets with Passphrase wallets |
| 2.1.4 | Optimized Zcash transaction QR code recognition |
| 2.0.2 | Added managing ZEC (Zashi, Zodl's former name); ZEC asset management moved from the Multi-Coin firmware to Cypherpunk |
The 3.0.2 upgrade is one-way
Keystone's note for 3.0.2 says: once upgraded, you cannot downgrade to the 3.0.0 Multi-Coin or Bitcoin-only firmware, and unless you need Ironwood support Keystone recommends not upgrading. If you hold shielded ZEC in Zodl, Zodl says the upgrade is required for Ironwood: without it you cannot sign transactions or migrate your Keystone funds.
Upgrade the Keystone firmware
Zodl's article "Upgrading your Keystone for Ironwood" (updated July 23, 2026) describes two ways. Its warnings first: charge the device to at least 50 percent, because a power loss during the upgrade could make it fail, and keep your recovery phrase, because a failed upgrade that needs a device reset can only be recovered with it.
With USB (a Chromium-based browser on a desktop):
- Plug the Keystone into your computer and approve the "Connect to This Device?" prompt.
- Open Keystone's Cypherpunk USB upgrade page (keyst.one/usb-upgrade?type=cypherpunk).
- Click Connect and choose "Keystone 3 Pro".
- Click Install Update and confirm your PIN on the device.
- Keep it plugged in until it restarts, then enter your PIN and check the home screen.
With a microSD card:
- Download the Cypherpunk firmware file, keystone3.bin, from keyst.one/firmware.
- Copy it to a microSD card formatted as FAT32.
- With the Keystone on, insert the card and tap Update at the "New firmware detected." prompt.
- Enter your PIN, wait a couple of minutes for the restart, enter your PIN again and remove the card.
Zodl advises the microSD method if you originally installed Cypherpunk with a microSD card. To check the result, open Device Settings, then About, on the Keystone: Zodl says the version should be v3.0.2 or later and it should be the Cypherpunk build. Keystone publishes a SHA256 checksum for every release; its page says you can hash the downloaded file and compare it with the published value, and an exact match means the file was not altered. The page mentions no cryptographic signature.
Connect the Keystone to Zodl
Zodl's article "Connecting a Keystone wallet" (updated April 2, 2026) says to upgrade to the Cypherpunk edition first, then:
- On the Keystone, create a new wallet or recover an existing one.
- On the Keystone, enter your PIN, open the menu at the upper right and choose to connect a software wallet, then select Zodl.
- In Zodl, tap the logo at the upper left and choose Connect Hardware Wallet.
- Tap Ready to Scan and scan the Keystone's QR code. The code changes, so scan the full sequence.
- In Zodl, select the wallet name you set on the Keystone and tap Unlock.
- Switch between your Zodl wallet and the Keystone wallet with the selector at the upper left.
Funding. A new Keystone wallet can receive funds directly or from your Zodl wallet via the Keystone entry in your address book. An existing Keystone wallet first shows 0.000 ZEC: open the menu, then More, Advanced Settings, Resync, tap Change, choose a month before you started using the Keystone wallet and tap Confirm.
Do not reuse your Zodl phrase. Zodl says not to import into the Keystone the same recovery phrase as your Zodl wallet. Its reasoning is that a hardware wallet's keys never touch an online device, so reusing a phrase from a hot wallet offers little benefit. Our explainer on the recovery phrase covers the basics.
Move Keystone funds to Ironwood
Ironwood is the shielded pool introduced by the NU6.3 upgrade; our status article covers the upgrade itself. Zodl's article "Migrating to Ironwood – Keystone Walkthrough" (updated August 8, 2026) names Zodl v3.9.0 and Keystone firmware v3.0.2 or later as prerequisites and describes the flow:
- After updating, tap Migrate on the prompt for your Orchard balance.
- Choose Migrate immediately or Migrate with privacy.
- Enable Tor (recommended; skipping it can expose your IP address to the server).
- Confirm the transfer plan, tap Start migration and authenticate.
- Scan each unsigned transaction on the Keystone. Larger balances need several batches, shown as "(1 of 3)". Review the paginated transactions and sign each batch.
- In Zodl, tap Get Signature and scan each signed batch. Zodl then schedules the broadcasts, and a widget on the main screen shows progress.
What Zodl says about the choices: the private option sends standardised amounts as several smaller transfers spread out over time, and a remainder from your Orchard funds is not moved by default; the immediate option sends your full balance to Ironwood in a single transaction and reveals the full amount. At the locking step you can sweep the remainder, which may be identifiable, or lock it locally; the lock does not carry over if you import the Keystone wallet elsewhere. Android broadcasts in the background on a best-effort basis; on iPhone Zodl must be the active app.
There is no deadline. Zodl's article "Moving your funds to Ironwood" (August 7, 2026) says Orchard funds do not expire and migration is not an urgent necessity, and a second article says the migration will never reach 100 percent because some coins are permanently inaccessible. The same article says the latest versions are required: without the update the wallet will not sync and you cannot send funds. See also the Zodl guide for the app-side view.
What we could not verify
- Shield button. Zodl's shielding article predates Ironwood, so we do not say which pool Shield targets for a Keystone wallet today. Check Zodl's shielding article first.
- Other firmware editions. Zodl's statement that only Cypherpunk supports shielded Zcash dates from April 2, 2026. Keystone's page mentions transparent ZEC address support in Multi-Coin 2.3.6, says ZEC asset management moved to Cypherpunk in 2.0.2, and describes no shielded support for Multi-Coin or Bitcoin-only builds, but it does not say outright that there is none. We cannot say whether a Multi-Coin build now handles shielded ZEC.
- The audit. Least Authority hosts a PDF titled "ZCG Keystone Hardware Wallet Final Audit Report"; our tooling could not read its text, so we do not state its scope, date, funding or findings. Read it yourself at leastauthority.com.
- Safety guarantees. None of the official pages promises that funds cannot be lost, and neither do we. Keep your recovery phrase offline and never share it.
Sources
Keystone firmware, Connecting a Keystone wallet, Upgrading your Keystone for Ironwood, Migrating to Ironwood: Keystone walkthrough, Moving your funds to Ironwood and When will the migration be complete?. For other wallets, including hardware options, see our wallet directory.