Trezor

Trezor is a hardware wallet manufactured by SatoshiLabs, a Czech company that shipped the first consumer hardware wallet in 2013. It enables self-custody of cryptocurrency by storing private keys on an offline device, keeping signing operations physically isolated from internet-connected computers. Trezor's firmware is fully open source and auditable on GitHub. Current Safe series models support over 8,000 assets.

Security

• Self-custody: Private keys are generated and stored on the device. The host computer sends unsigned transactions; the device signs them offline and never exposes the private key.
• Open-source firmware: All firmware is published under an open-source licence and verifiable by independent security researchers. Trezor Suite, the companion desktop application, is also open source.
• Secure element: The Safe 3, Safe 5, and Safe 7 include a certified secure element chip that enforces PIN verification and resists brute-force attacks. The Safe 7 uses TROPIC01, an open-source secure element developed by Trezor's Tropic Square subsidiary. The Model One and Model T do not include a secure element.
• Passphrase: Enabling a BIP39 passphrase (25th word) mitigates physical seed extraction risk on all models. Without one, researcher demonstrations have shown that seed phrases can be extracted from Model One and Model T units with physical access and specialised equipment. Separate research in March 2025 identified architectural weaknesses in Safe 3 and Safe 5 requiring physical access to exploit.

Product Lineup

• Trezor Safe 3 ($59): Monochrome display, EAL6+ secure element, USB-C.
• Trezor Safe 5 ($129): Colour touchscreen, EAL6+ secure element, microSD slot.
• Trezor Safe 7 ($249): Colour touchscreen, TROPIC01 open-source secure element, Bluetooth, wireless charging, post-quantum cryptography.
• Model One / Model T: Legacy models with no secure element. Passphrase use is recommended if still in active use.

Incident History

• January 2024: A third-party support ticketing provider was breached, exposing names and email addresses for approximately 66,000 users who had contacted Trezor support since December 2021. Attackers sent phishing emails requesting seed phrases. No user assets were compromised; forty-one cases of confirmed data exploitation were documented.
• March 2024: Trezor's X account was briefly accessed via social engineering of a team member. No wallet security or user assets were affected.
• No remote exploits compromising user assets have been publicly confirmed.