Trezor Reseña

Trezor review: the short answer

Trezor is a safe, open-source cold wallet if you buy it new and set it up yourself. No source we checked reports a remote hack of a Trezor device; every published hardware attack on a Trezor needed physical access.

This Trezor review covers the Safe 3, Safe 5 and Safe 7, plus the discontinued Model One and Model T. We checked every claim against Trezor's own pages, research from Ledger Donjon and Tropic Square, breach notices and IRS guidance on 16 and 17 October 2026. It is a desk review. We did not run our own device trials.

A lot changed in 2026. Prices fell around the turn of the year, a lab attack hit the Safe 7's TROPIC01 chip, and two Trezor suppliers leaked customer data. In October, Trezor also began cutting its reseller network.

• Good fit: you want firmware anyone can read, you hold mainstream coins, you would like to stake ETH, SOL, ADA or TRX in the Trezor app, and you will buy direct from trezor.io.
• Look elsewhere: you use Phantom or Solflare for Solana apps, you collect NFTs, you want full iPhone support under $249, or you want a service that can restore a lost backup.

Which Trezor should you buy in 2026?

Buy the Safe 3 ($59) if price matters most, or the Safe 5 ($129) for a colour touchscreen. The Safe 7 ($249) is the only current model with Bluetooth and full iPhone support.

The Safe 5 adds more than a nicer screen. It runs a newer microcontroller, which Trezor says the 2025 Safe 3 finding did not affect, and it has a microSD slot. Both cheaper models are USB-C only. On an iPhone, Suite gives them just portfolio tracking, buying and receiving.

Trezor unveiled the Safe 7 in Prague on 21 October 2025. It has a LiFePO4 battery, Qi2 wireless charging and an aluminium body rated IP54. Trezor markets it as "quantum-ready" because its firmware updates carry a post-quantum signature (SLH-DSA-128). Bluetooth pairing runs over Trezor's open-source Host Protocol. You can switch Bluetooth off.

Trezor One review: still worth buying in 2026?

Not as a new purchase, and the same goes for the Model T. Trezor stopped selling both on its own store on 8 January 2026. Neither has a secure element.

Existing owners keep their support. Trezor promises critical security updates until at least 2036 and basic maintenance until at least 2031. The Model One is the original Trezor, and it handles many coins rather than only Bitcoin, though it does not support Solana. Never buy either model second-hand. The tampered devices reported in October 2026 were exactly these two.

Is Trezor a cold wallet, and is it open source?

Yes to both. A Trezor cold wallet generates and keeps your private keys on the device, and the firmware for all five models is public on GitHub under open-source licences, mainly GPL-3.0.

The keys never sit on your computer or phone. You approve each transaction on the Trezor's own screen, and Trezor Suite, the companion app, cannot move funds without that approval. Trezor has no seed recovery service. You hold the backup. Its Multi-share Backup can split it into shares that you keep.

The code is public. One public repository holds the firmware, with a "legacy" codebase for the Model One and a "core" codebase for the other four models. The code for Trezor Suite and the Trezor Connect library is public on GitHub too, and Trezor calls the Host Protocol used for Bluetooth pairing open source.

The chips are less open. Safe models use Infineon's OPTIGA Trust M, certified to Common Criteria EAL6+, which releases a secret only after the correct PIN. Trezor calls it "NDA-free". It does not say the chip's internal firmware is public. The Safe 7 adds TROPIC01 from Tropic Square, a SatoshiLabs company. Trezor calls it "the world's only independently auditable secure element". We found no statement that its full design is published, so "auditable" is the accurate word.

Who makes Trezor?

SatoshiLabs, a Prague company founded in 2013, makes Trezor. Marek Palatinus and Pavol Rusnák co-founded it, and a 2017 Trezor post also names Alena Vranová, CEO until January 2017, as an original founder of SatoshiLabs. Palatinus is now CEO of SatoshiLabs, while Matěj Žák is CEO of Trezor.

Is Trezor safe?

Yes, for most owners. Every published hardware attack on a Trezor needed physical access, and the 2024 and 2026 data leaks hit outside providers and exposed contact details, not keys.

In the documented losses we found, the cause was a fake app or a tampered device, and phishing campaigns keep targeting Trezor customers. That shifts the risk. How you buy, set up and guard the device matters more than any chip.

How Trezor protects your keys

• PIN. It can be 4 to 50 digits long. The device wipes itself after 16 wrong tries, or 10 on the Safe 7.
• Passphrase. An optional extra phrase opens a hidden wallet. Kraken said a passphrase would have stopped its 2020 attack, and Trezor said the same of a 2023 one, both listed below.
• Firmware and authenticity checks. The bootloader checks the firmware signature at every connection. Suite checks the firmware hash and confirms that a Safe device carries a genuine secure element (both chips on the Safe 7).
• Entropy check. During setup, Suite verifies that the device followed Trezor's documented wallet-creation process and combined its own randomness with randomness supplied by Suite. If the check fails, setup stops and Suite warns that the device may be compromised. Older devices need a recent firmware for it.
• Clear Signing. Launched on 7 September 2026, it shows readable details instead of raw data when you sign with supported Ethereum and EVM contracts, such as Aave and Lido. It works on every model except the Model One.
• Transaction simulation. Blockaid previews what a transaction will do on EVM networks, and on Solana, Tron and Stellar from September 2026.

Has Trezor been hacked?

Not remotely, according to every source we checked. The incidents below are lab attacks on hardware, tampered devices, or scams that abused Trezor's name and its suppliers' systems.

The device attacks needed the wallet itself. The data leaks handed scammers contact details instead. Trezor says it will never deactivate your device. Anyone asking for your wallet backup is a scammer, it adds.

The Safe 7 TROPIC01 finding (June 2026)

On 3 June 2026, Ledger Donjon disclosed a laser attack on TROPIC01. It needs the device in hand, an opened chip package and about an hour of lab work, and it lets an attacker run their own code on the chip.

Researchers Charles Christen and Leo Benito chained two laser faults, so the chip first accepted and then ran an update with an invalid signature. Tropic Square rated the flaw medium (CVSS 5.7). It offers a partial firmware mitigation, which Donjon says can still be bypassed in under an hour. In Donjon's words, "the remaining barriers are in hardware".

Trezor agrees that firmware cannot deliver a full fix. Tropic Square plans new chips for late 2026, but Trezor "can't commit to whether or when" they will reach the Safe 7. Trezor says your keys and wallet backup are not stored on TROPIC01, and that breaking TROPIC01 alone does not reveal the PIN.

Treat that PIN point with some caution. Tropic Square and Donjon both found ways around MAC-and-Destroy, the feature behind PIN checks on the Safe 7, without publishing details. Donjon adds that some faults worked with the laser detectors switched on. Trezor says no user action is needed.

The Safe 3 finding (March 2025)

Ledger Donjon reported a Safe 3 flaw to Trezor on 12 November 2024, and Trezor disclosed it on 5 March 2025. By voltage glitching the microcontroller, the researchers bypassed the authenticity check and the firmware hash check, though they extracted no key or PIN. The risk is a tampered Safe 3 resold to you. Asked whether a firmware update could fix it, Trezor replied "Unfortunately not," Cointelegraph reported. Trezor says the Safe 5 is not affected.

Data leaks at Trezor's suppliers

Trezor says its own systems were not breached in 2026, but two of its suppliers were.

On 13 August 2026, Trezor disclosed that its shipping partner, ShipMonk, had exposed customer data. A 4 September update raised the count to 80,689 customers, about 67,000 of them US buyers from November 2019 to August 2021. Names, emails, phone numbers, shipping addresses and order numbers leaked, though for 1,947 customers only names, cities and emails were exposed. Trezor requires partners to delete order data 90 days after delivery. ShipMonk still held it. Trezor says devices, keys and backups were not affected.

On 9 September 2026, attackers used a login flaw at Brevo, Trezor's email provider, to send a fake "Critical Security Alert: STM32 Entropy Vulnerability" from Trezor's real address. Its link led to an app that asked for the wallet backup. Brevo confirmed that 347,149 contact email addresses were exported, and about 2,500 people clicked before the domain was taken down within 20 minutes. Brevo's postmortem counted 138 accessed accounts across its customers. No losses have been publicly confirmed.

Audits and bug bounty

We found no formal third-party audit report of Trezor's firmware. What exists is open-source firmware, repeatedly tested by outside researchers, plus an in-house bug bounty that researchers report to by email to Trezor's security team rather than through HackerOne or Immunefi. Critical bugs pay $1,000 to $100,000, with "no upper limit" in exceptionally disastrous cases. Rewards are paid in bitcoin.

Trezor's security page lists six reports from June to August 2026, all marked resolved but without fix dates. Two hit the Safe 7. In one, pairing through the Host Protocol could finish without the pairing code, and in the other, authenticity proofs were not bound to their secure element.

Trezor Suite: staking, swaps, coin control and Tor

Trezor Suite is the companion app for Windows, macOS, Linux, Android and iOS. You use it to buy, sell, swap and stake. Every transaction still needs your approval on the device.

Only the Safe 7 gets the full app on an iPhone. Trezor says its devices also work with "30+ wallet apps" through Trezor Connect, and Suite added a WalletConnect button for dApps in July 2026.

Staking and DeFi Yield

• Ethereum (ETH): through Everstake on all five models, with a 0.01 ETH minimum since June 2026.
• Solana (SOL): through Everstake since 20 March 2025, with a 1 SOL minimum and about two days to unstake.
• Cardano (ADA): through Everstake pools, on desktop only.
• Tron (TRX): on desktop since July 2026, and view-only on mobile.

Polkadot, Cosmos and Tezos staking are not offered. In May 2026 Suite also added stablecoin yield, which puts USDC and USDT into Morpho vaults curated by Steakhouse Financial, and in August Trezor renamed it DeFi Yield and added an ETH vault. Trezor says the yield is variable and not guaranteed. It has published no fee or country list.

Buying, selling and swapping

Suite compares quotes from eight buy providers, including MoonPay, Banxa and Revolut, and sells through Banxa, BTC Direct and MoonPay. Swaps run through five exchange services, such as Changelly and ChangeNOW, or through the on-chain aggregators 1inch and LI.FI. Trezor says trades happen "without your funds leaving your custody". That holds for on-chain routes. With an exchange service it does not, because you send coins first and trust the service to pay out.

Bitcoin tools and supported coins

Bitcoin users get coin control, Tor and a discreet mode. Trezor claims "1,000+ coins and tokens" but gives no network count. In February 2025 Suite dropped Dash, Bitcoin Gold, DigiByte, Namecoin and Vertcoin, though the firmware still supports them through other apps.

NFTs, Solana apps and other wallets

NFTs are a weak spot. Suite can list EVM NFTs behind an experimental setting, with no images. It cannot send or sell them. Trezor points NFT users to MetaMask, which supports Trezor in its browser extension but not in MetaMask Mobile. See our MetaMask review for the wallet itself.

Solana works in Suite on the three Safe models, and Trezor lists Backpack and NuFi as compatible apps. Phantom lists every Trezor model as unsupported, and Solflare's docs name only Ledger and Keystone. Exodus supports the Safe 7 only in its mobile app and skips Bitcoin-only firmware. Rabby appears on Trezor's list of compatible wallets.

How to buy a genuine Trezor

Buy direct from trezor.io, then let Trezor Suite run its authenticity and entropy checks during setup. Never buy from marketplaces, social-media shops or second-hand sellers.

Trezor ships US and UK orders from local warehouses. Resellers are another matter. On 13 October 2026, Trezor's chief commercial officer, Danny Sanders, told some resellers they lose their authorization on 1 January 2027. They may sell remaining stock through the holidays. Resellers that stay face stricter sourcing and handling rules. Trezor has not said how many are affected.

Trezor called the cut a "preventive step, taken out of an abundance of caution" after the CryptoBilis implant case involving Ledger devices. It also said "there is not a single piece of evidence that Trezor devices have been compromised", and later told Kim Zetter that this referred to new devices from authorized resellers, not to all devices. Check trezor.io/resellers on the day you buy. The list will shrink.

Joe Grand's tampered devices

Hardware hacker Joe Grand found two tampered devices and told Trezor about the first in August 2026, journalist Kim Zetter reported on 13 October. One was a Model T bought on Facebook Marketplace in Canada, and the other was a Trezor One from a TikTok shop that shipped from China. In both, the microcontroller had been swapped. The firmware produced one of about a dozen preset seeds.

In a reply added to Zetter's report on 15 October, Trezor said both came from unauthorized sellers and "there's no known way to use this attack on the current Safe devices". It says Suite's entropy check should catch such devices. Grand disputes how well Suite's checks catch them: he says the tampered Model T carries official firmware on a soldered microSD card in an attempt to pass the firmware integrity check, and that the latest Suite flags the Trezor One but still lets the owner keep using it. Both sides agree that tampered older Trezors exist and were sold outside official channels.

Setup checks that catch fakes

1. Download Suite only from trezor.io/trezor-suite. The fake iOS app of 2021 took at least $1.6 million.
2. Check that the device arrives without firmware. Trezor ships devices empty and says one with firmware already on it should not be used.
3. Install the firmware through Suite and let the authenticity check pass.
4. Create a new wallet on the device and let the entropy check finish. If Suite warns that the device may be compromised, stop.
5. Write the backup down yourself, and never use a recovery card that arrives already filled in.
6. Set a PIN, and consider a passphrase for larger balances.

What does Trezor cost?

The device is the main cost, at $59, $129 or $249. Trezor names no fee of its own for sending or trading, so you pay network fees plus whatever your buy, sell, swap or staking provider charges.

Trezor says exact trading fees "can't be displayed in advance", so compare the quotes in Suite before a large trade. MoonPay is the only provider whose price list we checked.

Can you cash out on Trezor, and does it report to the IRS?

Yes, you can sell crypto for cash through Banxa, BTC Direct or MoonPay inside Suite, depending on your country. Trezor does not file Form 1099-DA on your wallet activity, but a broker you sell through may.

The sale happens with the provider, not with Trezor. You pick a quote in Suite and approve the transaction on your Trezor. The provider pays you. You can also send coins to your own exchange account and sell there, after a small test transfer.

In the EU, Invity Finance, a SatoshiLabs sister company that began as Suite's trading comparison tool, holds a MiCA licence. The Czech National Bank authorised it on 11 February 2026, and ESMA's register shows it passported to seven EU countries. Trezor does not say that Invity runs the trading tab in Suite.

For US users, these IRS rules matter most:

• Trezor is not a reporting broker. The Form 1099-DA instructions exclude anyone who will "only provide hardware or software (by sale, license, or otherwise) that permits users to control private keys".
• Brokers do report. Custodial platforms and certain other brokers report gross proceeds for sales from 1 January 2025 and cost basis for certain sales from 1 January 2026. We did not confirm which Suite partners issue the form.
• The Form 1040 question applies. Sales, swaps, spending and staking rewards mean "Yes". Only holding, buying with dollars or moving coins between your own wallets means "No", unless you paid a fee in crypto.
• Staking rewards are income at fair market value in the year you gain "dominion and control" over them, under Revenue Ruling 2023-14.
• Pending bills are not law. Congress is considering changes to how staking rewards and small transactions are taxed, including a House Ways and Means markup on 16 September 2026. None had become law as of October 2026.

Our US crypto tax guide for 2026 covers rates and forms. This is general information, not tax advice.

Trezor vs Ledger

Pick Trezor if readable firmware and no seed-backup service matter most to you. Pick Ledger if you rely on Phantom or MetaMask Mobile, which support Ledger but not Trezor.

Solflare is a similar case. Its docs list Ledger and Keystone, but not Trezor.

Open code is the clearest difference. Ledger's own security team found the 2025 Safe 3 flaw and the 2026 TROPIC01 flaw. Our Ledger review covers that side.

Should you buy a Trezor?

Yes, if you value firmware anyone can inspect and you will buy direct from trezor.io. For most people the Safe 5 at $129 is the sensible pick.

The Safe 3 at $59 is a fine way to start, but it is the model hit by the 2025 supply-chain finding, so buying it new from Trezor matters even more. The Safe 7 makes sense if you use an iPhone or want Bluetooth. Its TROPIC01 flaw needs the device in hand and a lab, yet a full fix depends on new hardware that Trezor has not promised.

A Trezor is a poorer fit in three cases. Solana users who live in Phantom cannot sign with it there. Solflare's docs list only Ledger and Keystone. NFT collectors will find Suite's view-only list too thin. Past buyers should expect phishing after the ShipMonk and Brevo leaks, and remember that Trezor never asks for your backup. We score wallets on security, chain support, ease of use, pricing and transparency; see how we score wallets or our crypto wallets hub.

Sources

1. Trezor Safe 3, Trezor, accessed 16 October 2026.
2. Trezor Safe 5, Trezor, accessed 16 October 2026.
3. Trezor Safe 7, Trezor, accessed 16 October 2026.
4. How long will Trezor Model One and Model T be supported?, Trezor, accessed 16 October 2026.
5. trezor-firmware repository, GitHub, accessed 16 October 2026.
6. Secure elements in Trezor Safe devices, Trezor, accessed 16 October 2026.
7. What is the TROPIC01 chip?, Trezor, accessed 16 October 2026.
8. SatoshiLabs press kit, SatoshiLabs, accessed 16 October 2026.
9. Alena Vranová steps down as CEO (archived copy), Trezor, 17 January 2017.
10. PIN protection on Trezor devices, Trezor, accessed 16 October 2026.
11. Entropy check: how Trezor Suite verifies wallet generation, Trezor, accessed 16 October 2026.
12. Clear Signing comes to Trezor, Trezor, 7 September 2026.
13. TROPIC01 laser fault injection, Ledger Donjon, 3 June 2026.
14. TROPIC01 security advisory: disclosure and mitigation, Tropic Square, 3 June 2026.
15. Trezor response to the TROPIC01 chip disclosure, Trezor, 3 June 2026.
16. Security and bug bounty, Trezor, accessed 16 October 2026.
17. Trezor bug bounty program: scope, rules and rewards, Trezor, accessed 16 October 2026.
18. Donjon's Trezor Safe 3 evaluation, Trezor, accessed 16 October 2026.
19. Hardware wallet Ledger helps competitor Trezor resolve security vulnerability, Cointelegraph, 13 March 2025.
20. Kraken Security Labs: Trezor wallets can be exploited with 15 minutes of physical access, The Block, 31 January 2020.
21. Fake Trezor app in the App Store swindled $1.6M from users, ForkLog, 31 March 2021.
22. Recent customer data exposed in shipping provider incident, Trezor, 13 August 2026, updated 4 September 2026.
23. Security incident at Brevo, our third-party email provider, Trezor, 10 September 2026, updated 17 September 2026.
24. Brevo login flaw behind Trezor, BitBox and CoinTracking phishing, Cointelegraph, 11 September 2026.
25. Trezor wallets also compromised with implants, Zero Day (Kim Zetter), 13 October 2026, updated 15 October 2026.
26. Ledger pulls devices from Asian markets over spy implant as Trezor cuts resellers, Blockhead, 15 October 2026.
27. Trezor cuts reseller network after Ledger hardware wallet tampering reports, CoinCentral, 14 October 2026.
28. Trezor Suite, Trezor, accessed 16 October 2026.
29. Trade crypto in Trezor Suite, Trezor, accessed 16 October 2026.
30. Staking Ethereum in Trezor Suite, Trezor, accessed 16 October 2026.
31. Staking Solana in Trezor Suite, Trezor, accessed 16 October 2026.
32. MoonPay pricing disclosure, MoonPay, accessed 16 October 2026.
33. Interim MiCA register of crypto-asset service providers, ESMA, record updated 1 September 2026.
34. Instructions for Form 1099-DA, Internal Revenue Service, reviewed 30 April 2026.
35. Digital assets, Internal Revenue Service, reviewed 2 September 2026.
36. Revenue Ruling 2023-14, Internal Revenue Bulletin 2023-33, 14 August 2023.
37. Crypto's tax gray areas: Congress aims to clarify the rules, McGuireWoods, 30 September 2026.
38. Is Ledger open source?, Ledger, updated 7 October 2026.
39. Trezor unveils Safe 7, the first transparent, quantum-ready hardware wallet, FXEmpire, accessed 16 October 2026.
40. Recovering a wallet with Multi-share Backup, Trezor, accessed 16 October 2026.
41. Trezor Connect, Trezor, accessed 16 October 2026.
42. Trezor Safe device authentication check, Trezor, accessed 16 October 2026.
43. Trezor Suite update September 2026, Trezor, September 2026.
44. Cybersecurity firm claims it hacked private key from a Trezor T hardware wallet, The Block, accessed 16 October 2026.
45. Trezor security update: stay vigilant against potential phishing attack (archived), Trezor blog, January 2024.
46. Trezor security alert: unauthorized email and continued phishing attacks (archived), Trezor blog, January 2024.
47. Common scams and phishing affecting Trezor users, Trezor, accessed 16 October 2026.
48. Trezor discloses vulnerability in Safe 3 found by rival Ledger, The Block, March 2025.
49. THP pairing could be completed without the pairing code, Trezor, accessed 16 October 2026.
50. Authenticity proofs not bounded to their secure element, Trezor, accessed 16 October 2026.
51. Trezor Suite update July 2026, Trezor, July 2026.
52. Trezor Suite update June 2026, Trezor, June 2026.
53. Trezor Suite now supports Solana staking, CryptoSlate (press release), March 2025.
54. Stake Cardano (ADA) in Trezor Suite, Trezor, accessed 16 October 2026.
55. Staking assets in Trezor Suite, Trezor, accessed 16 October 2026.
56. Trezor launches USDC, USDT yield in Trezor Suite through Morpho, Cointelegraph, accessed 16 October 2026.
57. Earn yield on stablecoins with Trezor, Trezor, accessed 16 October 2026.
58. Trezor Suite update August 2026, Trezor, August 2026.
59. Coins removed from Trezor Suite and how to migrate your funds, Trezor, accessed 16 October 2026.
60. Managing NFTs with Trezor, Trezor, accessed 16 October 2026.
61. Hardware wallet hub, MetaMask Help Center, accessed 16 October 2026.
62. Keep your Solana (SOL) safe with Trezor, Trezor, accessed 16 October 2026.
63. Hardware wallets in Phantom, Phantom Help Center, accessed 16 October 2026.
64. Web app and extensions, Solflare docs, accessed 16 October 2026.
65. Getting started with Trezor Safe 7 on Exodus Mobile, Exodus Support, accessed 16 October 2026.
66. Trezor resellers, Trezor, accessed 16 October 2026.
67. Transaction fees in Trezor Suite, Trezor, accessed 16 October 2026.
68. The Czech National Bank grants the first crypto licence. Invity receives it., SatoshiLabs, February 2026.
69. Ledger CEO says sharded wallet keys could be shared if subpoenaed, Cointelegraph, May 2023.
70. Ledger supported coins and tokens, Ledger, accessed 16 October 2026.
71. Mailchimp insider targets Trezor crypto wallets in phishing scam, Decrypt, April 2022.
72. What Is Ledger Recover?, Ledger, updated 9 April 2026.
73. Wallet recovery made easy with Ledger Recover, Ledger, accessed 17 October 2026.