How it works
Trezor is a line of hardware wallets built by SatoshiLabs, a Prague company founded in 2013 by Marek Palatinus and Pavol Rusnák. Its first device, the Trezor One, shipped in August 2014 as the first Bitcoin hardware wallet on the market. Twelve years later the job is unchanged: generate a seed on a device with no network stack, then sign transactions without exposing the private keys to a computer.
The desktop companion, Trezor Suite, assembles an unsigned transaction and hands it to the device over USB. The Trezor shows the destination and the amount on its own screen, the owner confirms with a PIN, and the signed transaction returns to Suite to be broadcast. An optional passphrase derives a separate wallet from the same seed — the defence against physical extraction.
The line splits by chip. The Safe 3 and Safe 5 pair Trezor's open firmware with an Optiga Trust M secure element certified to Common Criteria EAL6+. The Safe 7 adds TROPIC01 from Tropic Square — a secure element published for inspection rather than merely certified — alongside the Optiga and an STM32U5 microcontroller: three chips from three vendors.
KYC & privacy
The device asks for nothing. No account, no email, no identity check, no telemetry — once a Trezor is in hand, no server knows it exists. Trezor Suite is open source, routes its connections over Tor if asked, and offers coin control. Coinjoin left Suite on 1 June 2024, after zkSNACKs shut down the coordinator it depended on.
Buying one is where identity enters. The official shop needs a name, an email address and a delivery address, and it passes that record to a logistics partner. On 13 August 2026 SatoshiLabs disclosed that one of them, ShipMonk, had been breached: 11,742 customers had their full name, email, phone number and shipping address exposed, and 1,947 more their name, city and email — 13,689 records, from orders placed between 10 May and 8 August 2026 and shipped to the US, UK, Sweden, Colombia, Brazil, Italy and Portugal. Trezor's own systems, the devices, the keys and the wallet backups were untouched, as were the contents of the parcels. It was the second such incident: in January 2024 a third-party support portal exposed the names and emails of up to 66,000 people who had written to support since December 2021, and 41 of them were then emailed directly and asked for their recovery seed.
The answer is Anonymous Delivery — a separate checkout that takes a nickname instead of a real name, unbranded packaging with a generic sender, pickup at a parcel locker, and deletion of shipping identifiers once the box arrives. It reaches the EU in September 2026 and the US by year-end. The shop already takes Bitcoin on-chain or over Lightning, plus Ether, USDC, Litecoin and Solana, through Confirmo.
Strengths and limits
Openness is the strongest argument. Firmware and hardware designs are published, and SatoshiLabs discloses findings that make it look bad — including two by Ledger Donjon, the security lab of its main competitor. In March 2025 Donjon showed that voltage glitching reaches the microcontroller on the Safe 3 and Safe 5, where cryptographic operations run even though the secure element holds the PIN and the seed. In June 2026 Trezor and Tropic Square published Donjon's laser fault-injection attack on TROPIC01, which bypassed firmware-signature verification on that chip under lab conditions. Neither cost a user any funds.
The limit is not the silicon. It is the parcel. A hardware wallet has to travel, and every warehouse, carrier and processor along that route is a database the device was built to make unnecessary. Two exposures in thirty months is a pattern rather than an accident, and a shipping list is a uniquely bad thing to lose here: it names people known to hold their own keys, at their home address.
Verdict
Trezor is the reference open-source hardware wallet, and the device keeps its side of the bargain: it never learns who owns it. What it cannot protect is the address a courier needs, and two vendor breaches in thirty months show why that distinction deserves more attention than the marketing gives it. Bought with Bitcoin, delivered to a locker, ordered under a nickname, it is close to the best answer on the market; ordered the ordinary way, it files your name and address in someone else's warehouse. Grade: A (9.1/10). Trust: CAUTION.
Trezor is the reference open-source hardware wallet, and the device keeps its side of the bargain: it never learns who owns it. What it cannot protect is the address a courier needs, and two vendor breaches in thirty months show why that distinction deserves more attention than the marketing gives it. Grade: A (9.1/10). Trust: CAUTION.
