Hardware wallet · only you hold the keys

Trezor review: open-source hardware wallets from Prague

Trezor, a Czech company, makes hardware wallets whose firmware anyone can read: devices that keep the keys to your crypto away from your computer. It is relevant if you plan to withdraw coins from an exchange and want to be able to check what the device is doing.

Go to trezor.io Buying first? Compare platforms

By PlatformCrypto.eu editorial team · checked on 13 October 2026

Trezor at a glance

Our verdict

Pros

Firmware and app are public under GPL-3.0, so anyone can audit them.
Every current model has a certified EAL6+ secure element.
Bitpanda lets you prove ownership of an address by signing with a Trezor.
A European maker that lists prices in euros in its own shop.

Cons

Polkadot, Sui, NEAR and Hedera are not supported.
Customers have been targeted repeatedly through outside email and support services, most recently via Brevo in September 2026.
Full Trezor Suite on an iPhone requires the Bluetooth Safe 7.

Type and price

Hardware wallet

Device
Desktop
App

Devices

Trezor Safe 3
Trezor Safe 5
Trezor Safe 7

Our coins

17 of our 21 coins

Coins with their own page on this site. Greyed out and struck through: Trezor cannot hold it itself. Checked on 13 October 2026.

Security

More than 2 million usersaccording to Trezor, as seen on 13 October 2026

Who makes Trezor

Trezor Company s.r.o. is based in Prague and belongs to the SatoshiLabs group. Trezor describes its first device, the Model One of 2014, as the world's first hardware wallet. Its app, Trezor Suite, runs on desktop, in a browser and on phones; the desktop version comes in English, German, French, Spanish, Italian, Czech, Brazilian Portuguese and Turkish.

The Safe range and what it costs

Since 8 January 2026 Trezor's shop sells only the Safe series. The prices are the euro amounts in the product data of Trezor's own pages, checked on 13 October 2026.

Model	Screen	Connection	Price in Trezor's shop
Safe 3	0.96" monochrome, two buttons	USB-C	€59
Safe 5	1.54" colour touchscreen	USB-C	€129
Safe 7	2.5" colour touchscreen	USB-C, Bluetooth, Qi2 charging	€249

Trezor's terms treat a shown price as excluding VAT unless stated otherwise, and the pages do not say, so the checkout total in your country may be higher. Suite itself is free.

Its Buy tab passes the purchase to providers such as MoonPay, Banxa and BTC Direct, which quote a price and check your identity. We compare a different route, buying on a MiCA-licensed exchange and withdrawing afterwards (our method).

Open code, secure chips and the passphrase

Trezor's firmware is published on GitHub under the GPL-3.0 licence, and Suite is public too, so outside researchers can read exactly what runs on the device. Each Safe model adds a secure element certified to EAL6+, which Trezor calls "NDA-free": no secrecy agreement with the chipmaker limits what Trezor publishes. The Safe 7 spreads its protection across three chips from three vendors.

The discontinued Model One and Model T have no secure element. For those, Trezor's answer to physical extraction is the passphrase, an extra word never stored on the device that opens a separate hidden wallet.

Phishing waves and published attacks

2019 and 2020, older models. Ledger's Donjon lab recovered a Trezor One PIN from power measurements, fixed in firmware 1.8.0. In January 2020 Kraken Security Labs read the encrypted seed from a Trezor One or Model T in about 15 minutes with the device in hand. Kraken said no firmware update could fix it; Trezor replied that the attack fails against a passphrase.
January 2024. An outside ticketing system leaked names and email addresses of up to 66,000 people who had contacted support, and a fake "Assets undergoing upgrade" email then reached newsletter subscribers through a third-party email provider.
2025 and 2026, Safe models. Ledger Donjon bypassed some anti-tampering checks on the Safe 3, which Trezor says the newer chip in the Safe 5 resists. In June 2026 Trezor disclosed a lab attack on the Safe 7's TROPIC01 chip and said it gives no access to PINs, funds or backups.
August 2026, ShipMonk. A breach at this shipping partner exposed names, addresses and phone numbers of about 13,700 recent customers, and later of some 67,000 US customers.
September 2026, Brevo. A fake "STM32 Entropy Vulnerability" alert sent through the breached newsletter platform reached roughly 347,000 subscribers. About 2,500 people clicked before Trezor took the domain offline.

The incidents that touched many customers ran through suppliers' mailing, support and shipping systems rather than through the devices. The phishing that followed asked for the backup, something Trezor says it never requests.

What Trezor Suite can and cannot hold

Most of the coins with their own page on this site work in Trezor Suite. The four that do not are Polkadot, Sui, NEAR and Hedera.

XRP, Cardano, Solana, TRON and Stellar are listed for the Safe models only; Stellar arrived in Suite in July 2025.
Avalanche works on the C-Chain alone, and Trezor warns that coins sent over another Avalanche chain can be lost.
HYPE has been visible since August 2026, on HyperEVM only.
Shiba Inu, Pepe, Chainlink and Uniswap share the address of your Ethereum account.

From a European exchange to your Trezor

Open Receive in Suite and press Verify, so the full address appears on the Trezor's screen, then compare it with what you pasted into the exchange. Trezor's reasoning: your computer can be compromised, its screen cannot.

How you prove the address is yours depends on the exchange:

Bitpanda has a hardware-wallet option for Ledger and Trezor that hands over to Trezor Suite for signing, on a computer only.
Bitvavo does not list Trezor among its connectable wallets; choose "My wallet isn't here" and upload a screenshot of the address in Suite.
Kraken takes a signature from EVM wallets, a Satoshi test or a self-certification.

Suite hands out a fresh bitcoin address for every receipt, so an exchange that verifies per address may ask again; reusing a verified address avoids that, at some cost to privacy.

Holding coins on a Trezor does not hide transfers from the tax office. From the 2026 reporting year, DAC8 requires EU platforms to send yearly totals of what you moved to self-hosted wallets, by crypto-asset, to the tax authority where you live.

Weighing up brands? Read our Ledger review or the crypto wallets overview.

In four steps

Moving crypto to Trezor

Buy on a licensed platform
Our comparison shows where your amount buys the most crypto. We only list platforms with a MiCA licence.
Copy your receive address
In the Trezor app, pick the coin and Receive. Check that the device's own screen shows the same address.
Match the network
When you withdraw, choose a network your wallet uses for that coin; the wrong one can cost you the coins. A memo or tag is rarely needed when the address is your own.
Send a small amount first
Once it arrives, send the rest. Above €1,000, and on some platforms sooner, EU rules mean you prove the wallet is yours, for example by signing a message.

Questions about Trezor

Is Trezor a safe hardware wallet?

Keys stay on the device, and you confirm addresses and transactions on its own screen, which malware on a computer cannot alter. The leaks of 2024 and 2026 exposed contact details held by outside suppliers rather than anything stored on devices. The realistic threat is a fake email or app that talks you into typing in your backup.

Can I keep Polkadot, Sui or Hedera on a Trezor?

Not at the moment. Trezor's own coin pages state that it does not support Polkadot, Sui, NEAR Protocol or Hedera, so those coins need a different wallet.

Do Trezor shop prices include VAT?

Trezor's shop terms say a displayed price counts as excluding VAT unless the page says otherwise, and that VAT is collected on orders in the EU and the UK. The product pages we checked did not mention VAT, so the basket total is the figure to go by. No customs duty applies within the EU.

Is the Trezor Model T still supported?

Yes. Trezor stopped selling the Model T and Model One in its shop on 8 January 2026, but has committed to critical security updates for both until at least 2036, and to new coins on the Model T until at least 2031.

What was the Trezor Brevo phishing email?

On 9 September 2026 attackers abused Brevo, the newsletter service Trezor used, to send a fake security alert from help@trezor.io to about 347,000 subscribers. Its link led to an app that asked for the wallet backup. Trezor took the domain down within 20 minutes and says no other system of its own was touched.

Is Trezor covered by MiCA?

No. Under recital 83 of MiCA, makers of non-custodial wallets fall outside the regulation, since the customer alone controls the keys. A provider that sells you crypto through Trezor Suite is a separate firm and needs a MiCA licence to do so in the EU.