Trezor

Is Trezor safe?

The hardware is; the customer data is not. A Trezor keeps your keys on the device, shows every transaction on its own screen and runs firmware that anyone can read and rebuild. No Trezor device has been hacked remotely. We score Trezor 83/100, a B. What drags it down is a run of incidents around the company, not the wallet: leaked customer data in 2024 and 2026, including about 81,000 home addresses, and phishing sent through Trezor's own channels in 2025 and 2026.

If you are moving savings off an exchange or out of a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary such as MetaMask, a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary like this is a large step up. Just buy it in a way that limits what Trezor, and its partners, know about you.

Trezor data breaches: what leaked

Date	What happened	Data
Jan 2024	Third-party support ticketing portal breached	Names and emails of about 66,000 users
Jun 2025	Contact form abused to send phishing that looked like Trezor support replies	No Trezor data breached, Trezor says
Aug–Sep 2026	Shipping provider ShipMonk hacked via a Metabase flaw	Names, emails, phones and shipping addresses of about 81,000 customers
Sep 2026	Newsletter provider Brevo breached and used to email Trezor subscribers	About 347,000 newsletter addresses

The ShipMonk breach is the serious one. Trezor first put it at nearly 14,000 recent customers, then added 67,000 US customers who ordered between November 2019 and August 2021. It says ShipMonk kept that older data despite written assurances that it had been deleted, and it was considering legal action. BleepingComputer reported that ShipMonk received extortion emails from the ShinyHunters gang. Trezor itself warned that the leak "could potentially expose affected individuals to physical security risks". That, plus repeated leaks of contact data, is why company record scores 40, close to Ledger at 38.

When the phishing comes from Trezor itself

Phishing usually does not count against a wallet. Here it partly does, because twice attackers used Trezor's own systems to send it. In June 2025 they submitted the support contact form in victims' names, so Trezor's automatic reply arrived from a genuine address and the scam continued in that thread. On 9 September 2026 an attacker who had breached Brevo, Trezor's newsletter platform, sent a fake "critical security alert" from [email protected] claiming an STM32 chip flaw could expose seeds. Trezor took the linked domain down within 20 minutes, but about 2,500 people had already clicked. It has not said how many entered a seed or how much was lost.

No device or firmware was compromised in either case, so the security record stays at 78 rather than lower. But the lesson is blunt: an email from the real Trezor address is not proof that Trezor sent it.

How Trezor protects your keys

Keys are created on the device and never leave it. The Safe 3 and Safe 5 add an EAL6+ certified secure element that guards the PIN, and the Safe 7 uses two secure elements, one of them TROPIC01, a chip whose design is open for audit. You get a standard 12-, 20- or 24-word backup, can add a passphrase that never sits on the device, and can use the device in multisigMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary. There is no vendor recovery service, so nothing about your key is ever sent to Trezor. Key management scores 90.

Physical attacks are the remaining risk. In March 2025 Ledger's Donjon team showed that a previously known voltage-glitching attack could bypass some supply-chain protections on the Safe 3, by desoldering its microcontroller. Trezor said the Safe 5 and the older Model One and Model T were not affected, and that the risk was largely theoretical for anyone who bought from official sources. A long PIN and a passphrase blunt it further.

Open source and clear signing

Trezor's firmware and its Suite app are open source under GPLv3, and builds can be reproduced from the published code. Its bug bounty pays up to $100,000 for core firmware bugs, with no cap in exceptional cases, and up to $20,000 for Suite. The gap is formal audits: we found no recent published audit of the firmware, so transparency scores 88 rather than higher.

On the device, you confirm the amount and the receiving address on a screen that malware cannot touch. For Ethereum contract calls Trezor reads the ERC-7730 clear-signing registry, the same open standard Ledger uses, to show what a call does. Where a dApp has not published a descriptor, you see raw data, and that is when to stop.

Trezor Suite now also offers stablecoin yield: USDC or USDT on Ethereum can be deposited into curated Morpho lending vaults, with each step clear-signed on the device. The keys stay on your Trezor, but the coins sit in a lending protocol while deposited, so they carry its smart-contract and borrower risk. That risk is outside this score.

How to stay safe with a Trezor

1. Buy from trezor.io directly, set the device up yourself and never use a recovery seed that came in the box.
2. Ship to a pickup point or work address if you can; Trezor's shipping data has leaked.
3. Write the backup on paper or metal and never type it into any website or form, whatever the email looks like.
4. Use a long PIN and add a passphrase for larger holdings.
5. Approve contract calls only when the device shows readable details.

How we scored it

Key management (90), transparency (88) and scam protection (85) are Trezor's strengths: keys behind a secure element, open code and on-device confirmation. Key security carries 30% of the score, and only keys that never leave a dedicated device can reach 90 on it. Company record (40) is the weakest factor because of the 2024 and 2026 data leaks, though it carries only 5% of the score, and security record (78) reflects phishing sent through Trezor's own support form and newsletter account.

Trezor scores above Ledger mainly because its firmware is open source and it has no key-recovery service, and above hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary such as MetaMask because its keys never sit on an internet-connected computer or phone and its code is fully open source.