Trezor Safe 3 / 5 / 7

What it is

The Trezor Safe line is SatoshiLabs' current hardware wallet range, with open-source firmware, a secure element and Bitcoin-only editions (trezor.io).

At a glance

Current security status

OK: Recommended, PIN always set. Minimum version: 2.12.5+. Checked Oct 17, 2026 on our security watch.

• Several 2025–26 issues (a BIP-39 side channel on unlocked devices, a multisig verification bug, an SD-protect lock bypass) are resolved in current firmware per Trezor's disclosures and changelog.
• Model One is not recommended for new buyers.
• Oct 2026: as a preventive step, Trezor is ending reseller authorizations effective Jan 1, 2027. Trezor says there is no evidence its devices were compromised. Buy direct from trezor.io.
• Sep 9, 2026: an attacker used Trezor's account at Brevo, its third-party newsletter provider, to send a phishing email with the subject "Critical Security Alert: STM32 Entropy Vulnerability" that pushed an app asking for the wallet backup. Brevo confirmed 347,149 newsletter email addresses were exported. Trezor says no Trezor product, wallet or account system was affected, and that it will never ask for your wallet backup.
• Source: Trezor firmware changelog
• Source: Trezor: multisig verification bug
• Source: Trezor: lock bypass
• Source: ENISA EUVD-2026-46400
• Source: Decrypt: Trezor cuts resellers
• Source: Trezor: Brevo incident (Sep 10, 2026; updated Sep 17)

Key features

• Secure element protection (trezor.io).
• Open-source security model (trezor.io).
• Bitcoin-only editions, for example Trezor Safe 7 Bitcoin-only (trezor.io).
• Multisig signing, covered by Trezor's own disclosure of a fixed multisig verification bug (trezor.io).

Buying and setup

Every brand: Buy only from the maker's own official store. Even listed or authorized resellers have been compromised. In October 2026, implanted Ledger devices that captured recovery phrases during setup were sold through CryptoBilis, a reseller Ledger's own site listed as authorized for Indonesia, Malaysia and the Philippines (Galaxy Research). Never restore an existing seed onto a device you didn't buy direct from the maker. Treat any device that arrives already set up, or with a printed or pre-filled seed, as compromised. Don't use it.

• Buy only from the maker's own official store (trezor.io), not from resellers, even ones it lists as authorized. Never use a device that arrives with a seed already written down.
• Set it up with our hardware wallet module, then pair it with Sparrow as a watch-only wallet.