Trezor Review: Safe 3, Safe 5, Safe 7 and the Discontinued Model One

Verdict: Trezor is the hardware wallet line made by Trezor Company s.r.o. in Prague, the team behind the first consumer hardware wallet in 2014. As of November 2026 the current line-up is the Trezor Safe 3, Safe 5 and Safe 7, all with an EAL6+ certified secure element and open-source firmware. The older Model One and Model T left the official shop on 8 January 2026 but still get security updates. Buy only from trezor.io or an authorised reseller, and treat any other “Trezor” website as suspect.

This review covers who makes Trezor, what each current model costs and does, the security model, the March 2025 Ledger Donjon research on the Safe 3, how to set one up, and the phishing patterns that target Trezor owners. All facts come from Trezor’s own pages and dated reports, checked in November 2026. If you are still choosing between brands, our Ledger vs Trezor vs Coldcard comparison sets the three side by side.

Who makes Trezor and is it a legitimate company?

Trezor is a real, long-running hardware wallet maker. Its about page names its founders, known as Slush and Stick, gives the legal entity as Trezor Company s.r.o., a Czech limited company with offices in Prague, and dates the company to 2013 and the first device, the Model One, to 2014. The only official shop and download domain is trezor.io.

Trezor sits inside the SatoshiLabs group. Trezor’s scams and phishing guide lists the authentic group domains as trezor.io, invity.io, vexl.it, tropicsquare.com and satoshilabs.com, plus the x.com/trezor and instagram.com/trezor.io social accounts. Anything else that uses the Trezor name, including look-alike domains and free website-builder pages, is not run by the company.

Which Trezor models are on sale in 2026 and what do they cost?

As of November 2026 the official Trezor shop lists three models: the Trezor Safe 3 at $59 (EUR 59), the Trezor Safe 5 at $129 (EUR 129) and the Trezor Safe 7 at $249 (EUR 249). Each is also sold as a Bitcoin-only edition. The Model One and Model T are no longer sold on trezor.io, although some resellers may still have stock for a limited time.

Prices are Trezor’s own list prices taken from the product pages in November 2026 and change with promotions and region. The Safe 7 runs on a 330 mAh LiFePO4 battery, and Trezor says Bluetooth can be switched off so the device works over USB-C only.

Is the Trezor Model One still safe to use after it was discontinued?

Yes, with limits. Trezor stopped selling the Model One and Model T through its e-shop on 8 January 2026 and promises critical security updates for both until at least 2036 and basic maintenance until at least 2031. After those dates the devices keep working, but Trezor cannot guarantee every function and recommends moving to a newer model over time.

The bigger practical limits are coin support and physical security. Trezor’s Cardano guide states that the Model One does not support Cardano, and Trezor’s coin list marks XRP, Solana, TRON and Cardano as supported only on some models. The Model One also has no secure element: Trezor’s own March 2025 blog names voltage-glitching seed extraction as “a previously known issue with Trezor Model One and Trezor Model T”, which matters if the device is stolen. A strong passphrase is the mitigation Trezor recommends, because the passphrase is never stored on the device.

How does Trezor keep your keys safe?

Trezor keeps your private keys on the device and shows every address and amount on its own screen for you to confirm, so malware on your computer cannot approve a payment alone. The Safe 3, Safe 5 and Safe 7 add an Infineon OPTIGA Trust M secure element certified to CC EAL6+, which protects the PIN and resists physical extraction if the device is lost or stolen.

• Open source: Trezor describes its firmware and Trezor Suite as open source, so anyone can review and build the code. The secure element was chosen because it does not need a non-disclosure agreement, which is why Trezor calls it “NDA-free”.
• Safe 7 design: the Safe 7 combines the OPTIGA chip with TROPIC01, a chip Trezor describes as fully auditable, and a hardened STM32U5 microcontroller, from three different vendors. Trezor also says the Safe 7 uses post-quantum signatures (SLH-DSA-128) for firmware updates and boot checks, a vendor claim we could not test.
• Backups: all current models support 12, 20 and 24-word backups, Single-share Backup and Advanced Multi-share Backup (SLIP-39 shares, where several shares together rebuild the wallet), plus an optional passphrase.

Trezor offers no cloud or ID-based recovery service comparable to Ledger Recover: the backup is only what you write down. Our guide on how to store a seed phrase covers paper, metal plates and multi-share layouts.

What did the 2025 Ledger Donjon research find on the Trezor Safe 3?

In March 2025 Ledger’s Donjon security team showed it could bypass the authenticity check and firmware hash check on the Trezor Safe 3 using advanced voltage glitching. Trezor’s 5 March 2025 blog confirms the finding, says no private key or PIN was extracted, says the Safe 5 is not affected thanks to a newer microcontroller, and states that users need to take no action.

The attack matters for supply-chain tampering, not remote theft. Trezor says it requires full physical access: opening the case, desoldering the microchip, modifying it with specialised tools and repackaging the device without visible traces. The practical defence is the same as for any hardware wallet: buy from trezor.io or an authorised reseller, check the seal, and let Trezor Suite run its genuine-device checks during setup.

What does “trezor company.site” mean and how do fake Trezor sites work?

A web address ending in .company.site is a free shop page built on Ecwid’s Instant Site service, where anyone can register a name such as “trezor-wallet.company.site”. It has nothing to do with Trezor Company s.r.o. The only official Trezor domain is trezor.io, so a Trezor-branded page on company.site, Google Sites, Wix or similar builders should be treated as a phishing or fake-shop risk.

Ecwid’s help centre confirms that every free Instant Site lives at an address like store123.company.site, where the first part is editable and “company.site” is fixed. Scammers use such free builders because they are quick to set up and carry a valid HTTPS padlock. Common patterns against Trezor users include:

• Fake “trezor.io/start” pages on other domains or builder subdomains that ask you to “verify” or “restore” your wallet by typing your recovery seed. Trezor states that any request for your wallet backup, PIN or passwords is always a scam.
• Look-alike domains with hyphens or extra words (for example “trezor.io-something.online”), where the real domain is whatever comes right before the last dot and the top-level domain.
• Fake support emails: on 23 June 2025 Trezor warned that attackers had abused its own contact form so that auto-replies carried phishing text in the subject line. Trezor said its systems and user data were not breached and the linked site was taken down.
• “Device deactivation” threats: Trezor states it cannot and will not deactivate your device.

Type trezor.io yourself or use a bookmark, and download Trezor Suite only from trezor.io/trezor-suite or the official app store listings linked from there.

How do you set up a new Trezor safely?

Setting up a Trezor is a short, guided process in Trezor Suite. Check the packaging and holographic seal, connect the device, install Trezor Suite from trezor.io, install the firmware Suite offers, let Suite run the authenticity check, create a new wallet, write down the backup on paper or metal, and set a PIN. Never use a device that arrives with firmware already installed.

1. Inspect the box. The Safe 5 guide says every unit leaves the factory without firmware and with a holographic seal over the USB-C connector. A damaged or missing seal is a reason to stop and contact Trezor Support.
2. Install Trezor Suite from trezor.io/trezor-suite. Suite runs on desktop and on iOS and Android, with full iOS support on the Safe 7 and limited iOS support on other models.
3. Install firmware. Suite installs the latest signed firmware. Trezor’s support pages say a device that already has firmware should not be used.
4. Create the wallet and backup. Write the words exactly as shown on the Trezor screen, never into a phone, cloud note or photo.
5. Set a PIN and, if you want extra protection, a passphrase. Send a small test amount first, then follow our guide to moving crypto from an exchange to a wallet.

Which coins and apps work with Trezor?

Trezor says its current models support thousands of coins and tokens across major networks, including Bitcoin, Ethereum and EVM networks such as Base and Arbitrum, Solana, Litecoin, Cardano and XRP, managed in Trezor Suite. Some assets, such as Monero and Bittensor, work only through third-party wallets, and the Model One supports fewer coins than the Safe models.

Trezor’s coin list marks Monero (XMR) as supported on some models through third-party wallets only. For Ethereum-based apps you can connect a Trezor to software wallets that support hardware signing, such as MetaMask, so the key stays on the Trezor while the app builds the transaction. For Bitcoin, desktop wallets like Electrum also support Trezor. Background on each network is on our Bitcoin and Ethereum pages.

How does Trezor compare with Ledger?

The main difference is openness versus convenience features. Trezor publishes its firmware as open source and uses an NDA-free secure element, while Ledger’s low-level OS stays closed under its chip vendor’s NDA. Ledger offers Bluetooth on more models and an optional paid ID-based recovery service, Ledger Recover. Prices overlap: as of November 2026 the Safe 3 lists at $59, the Ledger Nano X at $99.

Ledger figures come from Ledger’s shop and comparison pages. Our Ledger Nano X review covers Ledger Recover in detail. Whichever device you choose, it only helps if your coins actually leave the exchange: see is it safe to keep crypto on an exchange.

Crypto assets are volatile, and this review is not financial advice.