Trezor review 2026: open-source hardware wallets, tested against the facts
Trezor is one of the most trustworthy hardware wallets you can buy: fully open-source firmware, secure-element chips on every current model and a clean record of no remote device hacks. Its weak spot in 2025 and 2026 has been customer data held by suppliers, which fuels phishing, so buy direct and never type your backup into anything but the device.
Status as of October 2026: Trezor is made by SatoshiLabs in Prague, Czech Republic. The current range is the Trezor Safe 3, Safe 5 and Safe 7. The Safe 7 was announced on 23 October 2025 with Bluetooth and a new "transparent" secure element (Chainwire press release, 23 Oct 2025). The older Model One and Model T are no longer sold directly by Trezor (Coin Bureau, Jan 2026). Recent events: a supplier data breach that grew to about 81,000 customers (Aug to Sep 2026) and phishing emails sent through a hijacked email provider (Sep 2026). Details are below.
Verdict
If you want a hardware wallet whose code anyone can inspect, Trezor is the obvious choice. The Safe 3 is one of the cheapest secure-element wallets from a major brand. The Safe 5 adds a colour touchscreen. The Safe 7 adds Bluetooth, full iPhone support and a battery.
The devices themselves have held up well. Every published attack needs physical access, lab equipment and expert skills. The real risk is around the device: leaked customer lists, fake emails and fake apps. Trezor cannot fix those for you, but you can avoid them with a few habits we explain below.
At a glance
| Feature | Trezor (October 2026) |
|---|---|
| Type | Hardware wallet (cold storage) |
| Custody | Self-custody. Keys are created and kept on the device |
| Chains | Bitcoin, Ethereum and EVM networks, Solana, Cardano and, Trezor says, thousands of coins and tokens. Some coins need a third-party wallet app |
| Companion app | Trezor Suite for Windows, macOS, Linux, Android and iOS. Full iOS use needs the Safe 7 |
| Connection | USB-C on all models. Bluetooth on the Safe 7 only |
| Open source | Yes. Firmware and Trezor Suite are open source |
| Secure element | Safe 3 and Safe 5: EAL6+ secure element. Safe 7: TROPIC01 plus a second EAL6+ secure element |
| Backup | Single-share or multi-share (Shamir) backup, optional passphrase |
| Price (Trezor store) | Safe 3 about $59 to $79, Safe 5 about $129, Safe 7 $249 (Coin Bureau, 25 Jun 2026; Comparedge, Jul 2026). Launch prices were $79 for the Safe 3 and $169 for the Safe 5. Sales are common |
Fees
| Cost | What you pay |
|---|---|
| Device | One-off: about $59 to $249 depending on model |
| Trezor Suite app | Free |
| Swaps, buy and sell | Run by third-party providers inside Suite. Their spread or service fee is built into the quote. Trezor publishes no single swap fee |
| Staking | Available for Ethereum, Cardano and Solana. The staking provider takes a commission from rewards |
| Network fees | Paid to the blockchain on every send. You can set them in Suite |
Fees as of October 2026. Always compare the final amount in a swap quote with a second source before you confirm.
Is Trezor safe?
Your keys never leave the device, and every transaction must be confirmed on the Trezor's own screen. A computer full of malware still cannot sign a transaction without you pressing the button. The open-source firmware means outside researchers can check the code, and they regularly do.
Current models add a secure element, which makes physical attacks much harder than on the old Model One and Model T. Adding a passphrase creates a hidden wallet that stays safe even if someone extracts the device's seed. That is the single best upgrade for larger amounts.
Incident history
| Date | What happened | Response |
|---|---|---|
| 31 Jan 2020 | Kraken Security Labs extracted encrypted seeds from the Model One and Model T with about 15 minutes of physical access (The Block) | The chip flaw cannot be patched. Trezor said a passphrase defeats the attack |
| 3 Apr 2022 | A breach at Mailchimp let attackers email Trezor customers a fake "Trezor Suite" app (Silicon Republic) | Trezor had the domain taken down and paused newsletters |
| 17 Jan 2024 | A third-party support portal leaked names and emails of about 66,000 people who had contacted support (ForkLog, 22 Jan 2024) | Affected users warned. Trezor said no assets were compromised |
| 5 Mar 2025 | Ledger's Donjon team showed a voltage-glitching attack on the Safe 3 microcontroller, needing physical access and lab skills (The Block, 13 Mar 2025) | Trezor disclosed it and said the Safe 5 uses a glitch-resistant chip |
| 23 Jun 2025 | Attackers abused Trezor's support form so its auto-replies carried phishing content (The Block) | Phishing site taken down. Trezor said its systems were not accessed |
| Feb 2026 | Paper letters on fake Trezor and Ledger letterhead asked owners to scan a QR code and enter their recovery phrase (BleepingComputer) | Both firms repeated that they never ask for a recovery phrase |
| 3 Jun 2026 | Ledger Donjon found a laser fault attack on the TROPIC01 chip in the Safe 7 (Trezor blog, 3 Jun 2026) | Trezor said keys and backup are not stored on that chip, so funds are not at risk. No fix is possible for existing chips |
| 13 Aug 2026 | Shipping provider ShipMonk was breached. Names, emails, phones and addresses of about 13,700 customers leaked (BleepingComputer, 13 Aug 2026). In September Trezor said another 67,000 US buyers from 2019 to 2021 were exposed because ShipMonk had not deleted their data (BleepingComputer, 7 Sep 2026) | Trezor said its own systems and devices were not affected and warned of phishing and physical risks |
| 9 Sep 2026 | A breach at email provider Brevo let attackers send phishing from a real Trezor address to about 347,000 newsletter subscribers. About 2,500 clicked (BleepingComputer, 11 Sep 2026) | Phishing domain taken down within about 20 minutes. Brevo account suspended |
None of these incidents was a remote hack of a Trezor device, and Trezor has reported no device-level theft of user funds. The pattern is clear, though. If you have ever ordered from Trezor, assume scammers may know your name and address. See our security incident tracker for the full timeline.
Key features
- Trezor Suite: portfolio view, coin control and Tor for Bitcoin privacy, address-poisoning and scam-airdrop warnings, and connection to your own full node.
- Multi-share backup: split your recovery into several shares so no single piece of paper can empty the wallet.
- Passphrase wallets: hidden wallets protected by an extra word only you know.
- Third-party apps: Trezor says it works with 30+ other wallet apps. Use it to sign for a browser wallet while the keys stay on the device.
- Safe 7 extras: Bluetooth secured by Trezor's own encrypted protocol, a 2.5-inch touchscreen, wireless charging and an aluminium body (Chainwire, 23 Oct 2025).
- Bitcoin-only firmware: available for people who want the smallest possible attack surface.
Setting up safely
- Buy direct. Order from Trezor's own shop at trezor.io or an authorised reseller. Avoid marketplace sellers and second-hand units, because the 2025 Safe 3 attack targets tampered devices.
- Type the address yourself. Type trezor.io or use a bookmark. Fake "Trezor Suite" sites and apps have stolen seeds before.
- Let the device check itself. Trezor Suite runs a firmware authenticity check during setup. Stop if it fails.
- Write the backup on paper or metal only. Never photograph it or type it into a phone, computer or website. Trezor never asks for it by email, letter or phone.
- Add a passphrase once you are comfortable, and store it separately from the backup.
Read our seed phrase safety guide before you write anything down.
Pros and cons
| Pros | Cons |
|---|---|
| Fully open-source firmware and app | Repeated supplier data leaks (2022, 2024, 2026) that feed phishing |
| Secure element on every current model | Bluetooth and full iPhone support only on the $249 Safe 7 |
| No remote device hack on record | Some coins and NFTs need a third-party app |
| Strong backup options: multi-share and passphrase | The TROPIC01 chip finding cannot be fixed on existing Safe 7 units, though Trezor says funds are safe |
| Safe 3 is a low-cost entry point | Swap and buy fees come from third parties and vary |
Who Trezor suits, and who should look elsewhere
Good fit: long-term holders, Bitcoin savers and anyone who wants code they can verify. The Safe 3 suits a first hardware wallet. The Safe 5 suits people who want a touchscreen. The Safe 7 suits iPhone users.
Look elsewhere if: you want a card you tap on your phone with no recovery words (see Tangem). Also look elsewhere if you mainly trade on one chain every day and do not want to confirm every action on a device.
Alternatives
- Ledger: wider app ecosystem and a Bluetooth range, but closed-source secure-element firmware. See Ledger vs Trezor.
- Tangem: NFC cards with no screen and an optional seed phrase.
- SafePal: cheaper air-gapped hardware with its own mobile app.
Still deciding? Our best hardware wallets guide and hot vs cold wallets explainer can help.
Frequently asked questions
Is Trezor safe in 2026?
Yes, for the device itself. No remote hack of a Trezor device is on record, and the known attacks need physical access and lab equipment. The main risk is phishing that uses leaked customer data, such as the ShipMonk breach in August and September 2026.
Which Trezor should I buy?
The Safe 3, at about $59 to $79, is enough for most people. The Safe 5, at about $129, adds a colour touchscreen. The Safe 7, at $249, adds Bluetooth, a battery and full iPhone support. Prices are as reported in mid-2026 and are often discounted, so check Trezor's shop.
Was my data in the 2026 Trezor breach?
If you ordered between 10 May and 8 Aug 2026, or you are a US customer who ordered between November 2019 and August 2021, your name and contact details may have leaked through ShipMonk. Your coins are not exposed, but expect convincing scam emails, calls and letters.
Does Trezor work with MetaMask and other wallets?
Yes. Trezor says it works with more than 30 third-party wallet apps. The keys stay on the device and every transaction is still confirmed on its screen.
What happens if Trezor goes out of business?
Your coins live on the blockchain, not with Trezor. With your backup you can restore the wallet in other compatible wallets, and the open-source code remains public.