A Trezor keeps your private keys on a device that never hands them to your computer, and it forces every payment through a physical confirmation you have to approve. It does not stop you being persuaded to type your recovery phrase into a convincing website, and that persuasion is how most Trezor owners actually lose coins.
Listen to this article, about 13 minutes. A synthetic voice reads the article and announces each section title as it begins; tables are read row by row and the questions at the end are left out.
Recorded 27 October 2026 from the article as published that day. Press a chapter to jump there; the highlighted line is what is playing. A play button sits beside every section heading, and once you scroll past this player a bar at the bottom of the screen keeps the controls in reach. Tap or click any sentence to hear the reading start from there.
On this page: the narrow thing a Trezor actually protects, which models are still sold after the January 2026 retirements, what the secure element buys and does not, how owners actually lose coins, and the August 2026 shipping data exposure that grew by a factor of five in September.
Think you already know this? Five questions, one minute.
Every answer is on this page. Answer from what you know now; the page fills in the rest.
-
1. What are the two protections a hardware wallet provides, according to this page?
The unsigned transaction goes in, the signature comes out, and malware on the laptop never sees a key. Read the screen and address swapping malware fails; press through without reading and it does not. That is the whole list. Read the section
-
2. Which Trezor devices are sold new in 2026?
Trezor’s product update page states the Model One and Model T left the shop on 8 January 2026, with basic maintenance until at least 2031 and critical security updates until at least 2036. The Safe 3 page listed 59 US dollars on 6 September 2026. Read the section
-
3. What does the certified secure element in the Safe models protect against?
Trezor’s security page documents the OPTIGA Trust M chip and the public disclosure programme. Seed extraction by voltage glitching was a known weakness of the older models; the chip does nothing about the threat that actually empties wallets. Read the section
-
4. How do most Trezor owners actually lose coins, per Trezor’s own guidance?
Trezor’s scams and phishing page states any request for the wallet backup, PIN or codes is always a scam and that it will never contact you about your backup, through email, calls, AI generated voice, messaging apps or letters by post. Read the section
-
5. How did the 4 September 2026 update change the shipping data incident?
The notice first gave 11,742 full and 1,947 partial exposures for May to August 2026 orders, then added data the provider had retained from November 2019 to August 2021. No keys or devices were affected; what leaked is a phishing list that does not expire. Read the section
Trezor is made by SatoshiLabs in Prague and was the first hardware wallet anyone shipped. What matters more is what the current devices do, what changed in 2026, and where the protection stops.
What is a Trezor actually protecting you from?
A hardware wallet solves one narrow problem very well. Your private keys are generated on the device and stay there. When you send a payment, the unsigned transaction goes to the device, the device signs it internally, and only the signature comes back. Malware on your laptop never sees a key, because the key never travels.
The second protection is the screen. It shows the destination address and the amount, and nothing moves until you confirm on the hardware itself. That is the defence against address swapping malware, which quietly replaces a pasted address with the attacker one. Read the screen and the swap fails. Press through without reading and it does not. The same trade off is covered in what a cold wallet is and is not.
That is the whole list. Everything else people assume a hardware wallet does, it does not do.
Which Trezor models are still sold in 2026?
This changed recently and most published comparisons have not caught up. Trezor own product update page states that the Model One and Model T are no longer sold as of 8 January 2026, with limited availability through official resellers afterwards. The current range on trezor.io is the Safe 3, Safe 5 and Safe 7, each with a Bitcoin only variant.
Trezor has committed to keeping the retired devices alive rather than abandoning them. The same page states basic maintenance until at least 2031 and critical security updates until at least 2036, with new coin support on the Model T until at least 2031. If you own one, it keeps working and keeps getting security fixes.
| Model | Screen | Secure element | Sold new |
|---|---|---|---|
| Safe 3 | 0.96 in monochrome, 128 x 64, two buttons | OPTIGA Trust M (V3), CC EAL6+ | Yes |
| Safe 5 | 1.54 in colour touchscreen, 240 x 240 | OPTIGA Trust M (V3), CC EAL6+ | Yes |
| Safe 7 | 2.5 in colour touchscreen, 520 x 380, Bluetooth | Two: OPTIGA Trust M (V3) and TROPIC01 | Yes |
| Model T | 1.54 in colour touchscreen | None | No, retired January 2026 |
| Model One | 0.96 in monochrome | None | No, retired January 2026 |
Trezor lists the Safe 3 at 59 US dollars on its own product page, checked again on 6 September 2026. Safe 5 and Safe 7 prices were not shown on the pages I could reach, and the figures circulating on review sites disagree with each other and with the official Safe 3 price. The Safe 5 figure has since been read directly from the vendor at 129 US dollars, on 2 October 2026, in our review of the Safe 5 and its 20 word backup. Check the store directly. Those review sites earn commission on the link.
What does the secure element in the Safe models actually do?
The Safe 3 and Safe 5 use an Infineon OPTIGA Trust M (V3) chip certified to CC EAL6+, and the Safe 7 uses two secure elements, the OPTIGA plus a TROPIC01. That is from Trezor own hardware documentation, not a marketing summary of it, and the company runs a public bug bounty and vulnerability disclosure page where resolved issues are listed by name.
What that buys you is narrow. A secure element hardens the device against somebody who physically has it in their hands and the equipment to attack it. Seed extraction by fault injection, sometimes called voltage glitching, was a known weakness of the Model One and Model T, and Trezor documents it as addressed in the secure element models.
Trezor did not omit a secure element from the older devices by accident. Their explanation is that the chips available at the time required non disclosure agreements that conflicted with fully open source firmware, so they built around the problem with the passphrase and Shamir backup, and adopted a chip only once they found one without the NDA restriction. Whether openness or certification matters more is a genuine judgement call.
So the secure element matters if your realistic threat is a burglary or a lost device. It does nothing about the threat that actually empties wallets, which is being talked into revealing your backup. The same reasoning applies to the Ledger range, in the Nano S Plus review. It applies just as squarely to biometric unlocking, which is why a fingerprint sensor cannot stand in for your backup, as the D’CENT biometric wallet shows in detail.
How are Trezor owners actually losing their coins?
By typing their recovery phrase into something. Not by having their device cracked open.
Trezor own scams and phishing guidance is unusually direct about this. It states that any request for your wallet backup, PIN, passwords or codes is always a scam, and that Trezor will never contact you about your wallet backup. The channels it documents include fake emails and websites, phone calls, AI generated text, voice and video impersonation, messages on WhatsApp and Telegram, and physical letters sent by post. Fake websites now reach people through search itself: on 22 September 2026 three lookalike pages outranked the real vendor for the query, which is why confirming you are on the Trezor official website comes before plugging anything in.
The pattern that keeps working is a manufactured emergency. Your device will be deactivated. Your account has a KYC problem. A security issue requires you to validate your wallet now. Trezor names this specific script on its scams page. The urgency is the product; the story wrapped around it is interchangeable.
What happened in the August 2026 Trezor data breach?
On 13 August 2026 Trezor published an incident notice titled Recent customer data exposed in shipping provider incident. ShipMonk, one of its fulfilment providers, had its systems holding Trezor customer order data accessed without authorisation. The notice has been updated twice since, and the second update changed the size of it considerably.
The first figures were 11,742 customers with full exposure, meaning name, email address, phone number and shipping address, and 1,947 with partial exposure of name, city and email, covering orders shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal between 10 May and 8 August 2026.
Then on 4 September 2026 Trezor updated the notice to say the incident was larger than first reported. ShipMonk had also retained order data from an earlier period of cooperation running from November 2019 to August 2021, and roughly 67,000 further United States customers had full details exposed from that older set. If you read this article, or anything else about the incident, before early September, the number you took away was low by roughly a factor of five, and the window you checked your own orders against started years too late.
That older data is also the part that undercuts the reassurance in the first version of the notice. Trezor pointed to a 90 day retention policy as limiting the scope, which was true of its own systems and turned out not to be true of the provider holding the parcels. Trezor states throughout that its systems, hardware wallets, private keys and wallet backups were not affected, and nothing in the update changes that.
No keys were involved and no device was compromised. What leaked is a list of people who probably own Bitcoin, with their home addresses. Anyone who read the Ledger Nano X review on this site already knows why that is the dangerous part. The 2020 Ledger customer database leak produced years of targeted phishing, convincing fake support contact, and in some cases threats made to people at their homes. A shipping list is the raw material for exactly that, and it does not expire. Nor is this a 2020 story: in August 2026 the SafePal order leak put the home addresses of 39,798 hardware wallet buyers into circulation, and targeted phishing aimed at those buyers followed.
So the practical test is wider than it looked in August. If you ordered a Trezor into any of those countries between May and August 2026, or into the United States at any point between November 2019 and August 2021, treat every unexpected message about your wallet as hostile, including anything that arrives on paper. A shipping list does not expire and neither does your address.
Were your details in the shipping data exposure?
Two windows, from Trezor’s notice of 13 August 2026 and its update of 4 September. Pick the one that applies.
Source: Trezor’s incident notice, linked in the section above. Check the notice itself for any later update.
Is a Trezor better than a Ledger?
The full side by side, with prices, secure elements and the open source question weighed against each other, is in the honest Trezor and Ledger comparison. The short version is that for most people the difference between the two brands is smaller than the difference between backing up properly and backing up badly. Both keep keys off your computer. Both make you approve on the device. Both are undone by a phrase typed into a phishing page. That is a boring conclusion and it is the correct one.
| Situation | What a Trezor changes | What it does not change |
|---|---|---|
| Malware on your laptop | Keys never leave the device, so they cannot be read | Nothing, if you approve a malicious transaction |
| Someone steals the device | PIN, and on Safe models a certified secure element | Nothing, if your written backup is in the same drawer |
| A site asks for your recovery phrase | Nothing at all | The phrase alone controls the coins, device or no device |
| Your backup is lost or destroyed | Nothing, the device is not the backup | Only a tested, durable, offline written record helps |
| A letter or call claims to be support | Nothing, this is entirely a human decision | Trezor states it will never ask for a backup or PIN |
The passphrase is the one feature genuinely worth understanding. It is an extra secret layered on top of the recovery phrase, and Trezor notes it is never stored on the device, so it cannot be extracted even by a physical attack. It is also unrecoverable. Forget it and the coins behind it are gone. Typing one of those on a two button device is its own hazard, which is the practical case for a full keyboard on a signer like the Coldcard Q. The trade offs are covered in what self custody actually asks of you.
What should you check before setting up any hardware wallet?
- Buy from the manufacturer or a listed official reseller, never from a marketplace listing.
- Expect to write the backup down on paper or steel at setup, before any coins arrive.
- Confirm the device generates the backup itself. One that arrives with a phrase already printed is a trap.
- Decide in advance where two copies of the backup will live, in different buildings.
- Assume any message about your wallet is fraudulent until you prove otherwise through a channel you chose.
None of that depends on which brand you pick. The framework for that choice, with no recommendation attached, is in how to choose a crypto wallet.
So where does that leave the Trezor?
The Safe range is competently built, with an open source firmware policy, a certified secure element, and a support commitment on retired hardware running to 2036. Those are checkable facts, and they sit on Trezor own site rather than in a review.
They are also not what decides whether you still hold your coins in five years. That is decided by whether your backup survives a house move, and whether you hold your nerve when a well written message says your wallet needs urgent validation. If splitting the risk across several devices sounds like the fix, a 2 of 3 takes the list of things that must survive from two to nine, and the reported failures are paperwork rather than hardware. The device cannot help with either. It was never designed to.
Frequently asked questions
Is the Trezor Model One discontinued?
Yes. Trezor product update page states the Model One and Model T are no longer sold as of 8 January 2026, with limited availability through official resellers afterwards. Existing devices keep working, with basic maintenance committed until at least 2031 and critical security updates until at least 2036.
Does a Trezor protect me if I get phished?
No. If a recovery phrase is entered into a website, form or app, that phrase alone controls the coins and the hardware becomes irrelevant. Trezor own guidance states that any request for your wallet backup, PIN, passwords or codes is always a scam. A recovery phrase should never be typed anywhere.
Was I affected by the August 2026 Trezor data breach?
Possibly, and the answer widened on 4 September 2026. The original notice of 13 August covered orders shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal between 10 May and 8 August 2026, with 11,742 customers fully exposed and 1,947 partially. The update added roughly 67,000 further United States customers whose order data dated from November 2019 to August 2021. Trezor says affected customers were contacted by email, and that no keys, backups or devices were involved.
Do I need a Trezor with a secure element?
That depends on whether physical theft is a realistic concern for you. The Safe 3, Safe 5 and Safe 7 carry a certified secure element that addresses fault injection attacks known on the older models. It makes no difference at all to phishing, which is the more common way funds are lost.
What is a Trezor passphrase?
A passphrase is an extra secret layered on top of the recovery phrase. Trezor notes it is never stored on the device, so it cannot be extracted physically. It is also completely unrecoverable if forgotten, so it adds a second thing that must never be lost rather than simply adding safety.
Can Trezor support recover my wallet if I lose my backup?
No. There is no reset, no identity check and no account recovery. Nobody at Trezor can restore access, and any message claiming otherwise is fraudulent. This is why the written backup, stored offline in two separate places and checked at setup, is the part that genuinely matters.
What can someone actually do with my leaked shipping address?
Target you personally rather than at random. A shipping list identifies people who probably hold Bitcoin, with a name, a phone number and a home address attached. That is the raw material for convincing fake support contact, for letters that arrive on paper looking official, and after the 2020 Ledger leak, in a documented minority of cases, for threats made to people where they live. No device setting changes any of this. What helps is refusing to act on any unexpected contact about your wallet, whatever form it arrives in.
Finished the page? The same five questions from the top, to see what stuck.
This article is educational and is not financial advice. Nothing here is a recommendation to buy, sell or hold anything. You are responsible for your own security decisions.
Leave a Reply