Trezor built the first hardware wallet in 2013, and thirteen years later it is still the most transparent company in the category. That transparency has a consequence most reviews skip: because Trezor publishes what researchers find, there is a public list of ways its devices have been broken. This Trezor review works through that list honestly, tells you which model actually suits your situation, and covers the 2026 incident that changed the risk picture more than any chip flaw did.

What Trezor Is and Who Should Use It

Trezor is made by SatoshiLabs, based in Prague, and it is the company that invented the category — the first hardware wallet shipped in 2013. It says it secures crypto for more than two million users, and that it is fully self-funded with no VC money behind it. Everything from the firmware to the desktop app is open source, and the full range sits on the official Trezor store.

A hardware wallet exists to do one narrow job: keep your private keys off an internet-connected computer and make you physically confirm every transaction on a screen the malware cannot touch. Trezor does that job well across all three of its current models. The question is not really whether Trezor works. It is which one you need, and what risks remain after you have bought it.

The Trezor Lineup and What Each Model Costs

Bundles knock a little off: the Safe 7 with Keep Metal is USD 330 instead of USD 348, the Safe 5 bundle USD 205 instead of USD 228, the Safe 3 bundle USD 142 instead of USD 158. Accessories are extra — a privacy screen protector is USD 20 and a case for the Safe 7 is USD 39.

The Bitcoin-only editions deserve a mention because they cost nothing extra. Firmware that speaks only one protocol is firmware with less code to attack. If you hold only Bitcoin, take that option.

The Trezor Security Record, Read Honestly

This is the part a brand-level review owes you, and it is where Trezor looks worse than closed competitors for a reason that is actually to its credit: it publishes.

2023 — Model T, read protection downgrade. The security firm Unciphered demonstrated extraction of the seed from a Trezor Model T using an RDP downgrade attack. It needed physical possession of the device and roughly ten GPUs to crack the result. Trezor pointed out it had disclosed the same class of attack back in 2020, that it could not be fixed in software, and that a passphrase defeats it.

2025 — Safe 3, voltage glitching. Ledger’s Donjon research team found that by desoldering the microcontroller and applying precisely timed voltage fluctuations, they could bypass the firmware integrity check on the Trezor Safe 3. Trezor confirmed the researchers could not extract private keys or PINs, that the secure element still protected those, and that no user action was needed. It also confirmed something buyers should hear plainly: asked whether the fix came by firmware update, Trezor answered “Unfortunately not.” The Safe 5 uses a newer microcontroller that resists the attack. The Safe 3 is still on sale at USD 59.

2026 — Safe 7, laser fault injection on TROPIC01. Donjon again, disclosed in June 2026: a laser fault-injection attack on the new auditable secure element, extracting one of three secrets protecting the PIN and some device-attestation material. It requires physical possession, chip decapsulation and laboratory equipment, and it must be repeated at every power-up. Trezor’s layered design means keys and backups were not exposed. It is also a hardware-level flaw that firmware cannot patch; the fix lands in the next chip generation.

Notice the pattern rather than the individual entries. Every one of these attacks requires an adversary to be holding your device, with lab equipment, for an extended period. None is remote. None has ever been used to drain a wallet in the wild that either company has documented. And in every case a strong passphrase — a word only in your head, never written on the seed card — puts the funds out of reach even if the device is fully compromised.

The honest summary is that Trezor’s threat model is physical, and its published record is a feature of an open company rather than evidence that it is less safe than a rival that simply does not tell you.

The 2026 Breach That Actually Changed the Risk

In August 2026, ShipMonk — the third-party fulfilment partner that ships Trezor orders — was breached. Trezor’s own disclosure is unambiguous about the scale: 80,689 customers affected. Of those, 11,742 had full details exposed, 1,947 partial, and around 67,000 were older US orders from November 2019 to August 2021. The primary window for recent orders was 10 May to 8 August 2026, across the US, UK, Sweden, Colombia, Brazil, Italy and Portugal.

What leaked was names, email addresses, phone numbers, shipping addresses and order numbers. Trezor states that its own systems and devices were not touched, parcel contents were not exposed, and private keys and wallet backups were unaffected. All of that is true and it matters.

The detail worth pausing on is in Trezor’s update of 4 September 2026. The breach turned out to be larger than first reported because it contained order data from a cooperation that ended in 2021 — data that should not have existed any more. In Trezor’s own words, throughout the relationship it “repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications,” and it is “very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.” That is a straight admission that a supplier’s written promise was the only control, and the promise was worthless.

It also misses the point that should worry a buyer. Every attack in the previous section needs physical access to your device. A leaked list of home addresses belonging to people who are known to own crypto hardware is exactly the input a physical attacker needs. Add the complaint that turns up repeatedly in Trezor’s own one-star reviews — that the shipping box advertises what is inside — and the picture is uncomfortable.

Trezor’s advice to affected customers is sensible: expect phishing by email, phone and physical mail, never type a wallet backup anywhere, verify communications against official channels, and for future orders use an anonymous email address and consider paying in crypto or with a disposable card. Take that advice. If you were in the affected window, treat any unexpected contact about your Trezor as hostile until proven otherwise.

What Actually Protects You

• A passphrase. This is the single highest-value setting on any Trezor. It creates a hidden wallet that cannot be reached from the seed alone, and it neutralises every physical attack above.
• Multi-share Backup. Splits your recovery into shares so one stolen card is not the whole wallet.
• Buying direct. Order from Trezor or an authorised reseller only. Supply-chain tampering is the one attack that does not need the researcher-grade equipment, and it is the reason both Trezor and Ledger say the same thing here.
• A steel backup. The most common way people lose crypto is not an attacker at all — it is a lost, damaged or illegible seed phrase.
• Delivery hygiene. After 2026, an anonymous email and a delivery address that is not your home are reasonable precautions rather than paranoia.

Trezor Suite and Where It Falls Short

Trezor Suite is the desktop and web app that manages the device: portfolio view, send and receive, coin control for Bitcoin, buying, selling, swapping and staking. It is open source and it is genuinely good software, and it is a fair part of why people stay with the brand.

Two gaps are worth knowing before you buy. Monero is not supported natively in Suite at all — you need a third-party wallet — and on the newest Safe 7 it is not usable yet even that way, because third-party app support is still pending, while the Safe 3, Safe 5 and Model T all handle it. If XMR matters to you, the flagship is currently the wrong Trezor. Second, Trezor’s Monero derivation uses SLIP10 rather than standard BIP39 or SLIP39, so an XMR backup may not import cleanly into a non-Trezor wallet.

Pros and Cons

Pros

• Open-source firmware and app — verifiable rather than trusted
• A genuine price ladder from USD 59 to USD 249, so the entry point is low
• Bitcoin-only firmware at no extra cost
• Publishes vulnerabilities rather than burying them, and works with rival researchers
• Passphrase and Multi-share Backup are strong, well-documented defences
• Trustpilot 4.6 from 1,998 reviews, and the company replies to 97% of negative ones

Cons

• A third-party shipping breach exposed 80,689 customers’ names, phones and home addresses in 2026
• The USD 59 Safe 3 carries a microcontroller weakness that Trezor confirmed was not fixed by firmware, and it remains on sale
• The Safe 7’s new TROPIC01 chip has a published, hardware-level flaw awaiting a next-generation fix
• Returns are 15 days and only for unopened, sealed products — there is no trying it
• Monero is unusable on the flagship Safe 7 and unsupported in Trezor Suite generally
• 13% of Trustpilot reviews are one-star, a high share for a 4.6 average

Prices, Returns and Warranty

Returns run 15 days from delivery, and the product must be unused and sealed in its original packaging with all materials in original condition. An opened Trezor cannot be returned. In the USA and UK the company provides a prepaid label and deducts its cost from the refund; everywhere else the customer pays return shipping. Refunds take up to 10 days after the parcel reaches the warehouse. The warranty is two years for individual customers and one year for business customers.

The practical consequence is the same on every model: you cannot open a Trezor, try it and change your mind. Decide which one you want before you order, and check the current bundle pricing on the Trezor store since the backup bundles are often better value than buying the pieces separately.

What the 4.6 Rating Actually Says

Trezor holds 4.6 out of 5 on Trustpilot across 1,998 reviews, with 625 of those in the last twelve months. That is a real sample and a good score. The distribution is more informative than the average: 77% five-star, 5% four-star, 3% three-star, 2% two-star and 13% one-star.

One in eight reviewers rating a product one star is high, and the shape — a big peak at five and a second bump at one — usually means two different experiences rather than one. Reading the one-star reviews, they cluster on support outcomes after something has already gone wrong, not on the devices failing. Trezor invites customers to review, holds a paid Trustpilot subscription and replies to 97% of negative reviews, typically within a day. Those are facts about how the score is produced, not accusations; weigh them accordingly.

Which Trezor Should You Buy?

If you are moving a modest amount off an exchange for the first time, the Safe 5 at USD 129 is the one to get. It has the touchscreen that makes address verification bearable, and it uses the newer microcontroller that resists the 2025 glitching attack. The Safe 3 at USD 59 is tempting and it is a real hardware wallet, but you are buying the model with the known unpatched weakness to save USD 70, and that is a poor trade for anything you would miss.

Buy the Safe 7 at USD 249 if the holding is large enough that a bigger, brighter confirmation screen genuinely reduces your chance of approving the wrong address, or if you sign from a phone often. Skip it if you need Monero or want a strictly air-gapped device.

Whatever you choose, budget USD 99 for a Keep Metal on top. A steel backup protects against the failure mode that actually happens to people. Compare the current Trezor models and bundles here before deciding.

Verdict

Trezor earns a strong recommendation with clear eyes. The hardware is good, the software is good, the company has been doing this longer than anyone and it tells you the truth about its own products — which is rarer and more valuable than a spotless marketing page. A 4.3 out of 5 reflects a brand you can reasonably trust with your keys.

What holds it back is not the chips. It is that a company built on privacy let a shipping partner put 80,689 customers’ home addresses into the wrong hands, in a product category where the entire published attack surface begins with somebody physically finding you. Buy the Safe 5 or the Safe 7, set a passphrase on day one, put the seed on steel, and think carefully about where the parcel is delivered. Do those four things and Trezor is about as safe as self-custody gets. Check current Trezor prices and stock on the official store.

Trezor FAQ

Has Trezor ever been hacked?

No Trezor has been drained remotely. Researchers have demonstrated physical attacks — an RDP downgrade on the Model T in 2023, voltage glitching on the Safe 3 in 2025, and laser fault injection on the Safe 7’s TROPIC01 chip in 2026 — but all require possession of the device and laboratory equipment, and a passphrase defeats them. Separately, a third-party shipping partner was breached in 2026, exposing customer contact details but no keys.

Which Trezor model is best value?

The Trezor Safe 5 at USD 129. It has a colour touchscreen and the upgraded microcontroller that resists the 2025 glitching attack, without the Safe 7’s price. The Safe 3 at USD 59 works but carries a weakness Trezor confirmed was not fixed by firmware.

Can I return a Trezor if I change my mind?

Only within 15 days and only if it is unused and still sealed in its original packaging. An opened device cannot be returned. The warranty is two years for individuals and one year for business customers.

Was I affected by the 2026 Trezor data breach?

Affected customers were emailed directly from security@trezor.io. The main window was orders delivered between 10 May and 8 August 2026, plus older US orders from November 2019 to August 2021, in the US, UK, Sweden, Colombia, Brazil, Italy and Portugal. Only contact and shipping details were exposed — no keys or backups.

Does Trezor support Monero?

Not in Trezor Suite. Monero works on the Safe 3, Safe 5 and Model T through third-party wallets such as the Monero GUI. On the Safe 7 it is in firmware but not yet usable, because third-party app support is still pending.

Disclosure: this review contains affiliate links. If you buy through them we may earn a commission at no extra cost to you. It does not change our assessment — the criticisms above stand either way.