Is Trezor Suite safe to connect?
Self-custody wallet · Bitcoin, Ethereum, Other coins supported by Trezor devices. Checked 2026-10-26; every line links its source.
Worst case: Trezor Suite is self-custody, so no one can freeze your coins, but anyone who gets your recovery seed can empty every account it backs up, and that cannot be reversed. Fake Trezor Suite downloads (2022) and phishing built on leaked support and shipping data (2024, 2025, 2026) are designed to get that seed.
Safe setup in 3 steps
- Download Trezor Suite only from trezor.io/trezor-suite or github.com/trezor/trezor-suite/releases (mobile: App Store id1631884497 or Google Play io.trezor.suite), and check the desktop installer's GPG signature against the 'SatoshiLabs 2021 Signing Key' (fingerprint EB48 3B26 B078 A4AA 1B6F 425E E21B 6950 A2EC B65C), as Trezor's download guide explains
- Never share your recovery seed or make a digital copy of it. Trezor will never contact you about it, so treat any email (even one from help@trezor.io), call, letter or 'vault'/'update' link that asks for it as phishing, and reach support only via trezor.io/support
- Verify every address and amount on the Trezor's own screen, not just on your computer, before confirming, as Trezor's scams-and-phishing guide advises
What it can do with your money
| Who holds the keys | You hold the keys Self-custody. Trezor Suite is the companion app for Trezor hardware wallets; Trezor says you keep 'full control of your private keys' and that crypto 'is not stored on your Trezor' (it lives on the blockchain, and the device holds the keys). Your recovery seed restores everything, and Trezor says it will never contact you about it. source |
|---|---|
| Can funds be sent out to any address? | Yes. You confirm every send on the device yourself, to any address. Anyone with your recovery seed can do the same from another device, and nobody can reverse it. source |
Official links
- Website:
trezor.io - X:
@trezor - GitHub:
github.com/trezor - GitHub:
github.com/trezor/trezor-suite - App:
https://apps.apple.com/app/id1631884497 - App:
https://play.google.com/store/apps/details?id=io.trezor.suite
Where we confirmed these
Known fakes
suite.xn--trzor-o51b.com· 2022-04-03 sourcetrezorwallet.org· 2022-04-03 sourcetrezor.us· 2022-04-03 sourcesuite.trezoriovpjcahpzkrewelclulmszwbqpzmzgub37gbcjlvluxtruqad.onion· 2022-04-03 sourcevault.trezor.guide· 2025-06-24 source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-08-10 | Customer shipping data leaked through Trezor's fulfilment chain: Metabase told fulfilment partner ShipMonk on 2026-08-06 of unauthorized access, and ShipMonk told Trezor on 2026-08-10. 13,689 customers who ordered between 2026-05-10 and 2026-08-08 were affected: 11,742 had full name, email, phone number and shipping address exposed, and 1,947 had name, city and email exposed (US, UK, Sweden, Colombia, Brazil, Italy, Portugal). | Trezor says its own systems and devices were not compromised and warned of phishing by email, phone and letter. No loss of funds reported. | source | |
| 2025-06-24 | Reported date: attackers abused Trezor's support contact form, opening tickets whose titles were phishing messages. Trezor's automatic reply then came from the real help@trezor.io, carrying lines such as '[URGENT]: vault.trezor.guide - Create a Trezor Vault now...' that led to a page asking for the wallet seed. | Trezor warned users on X, repeated that it never asks for the seed, and said it was working on defenses | source | |
| 2024-01-17 | Unauthorized access to a third-party support ticketing portal used by Trezor (detected 2024-01-17, 20:20 CET). Names or nicknames and email addresses of up to 66,000 people who contacted Trezor Support since December 2021 may have been exposed. The attacker emailed 41 of them asking for their recovery seed. | Trezor says no user funds were compromised and no seeds were disclosed. It alerted the 41 users within an hour and emailed everyone potentially affected on 2024-01-20. | source | |
| 2022-04-03 | Phishing through Trezor's MailChimp-hosted newsletter: MailChimp told Trezor an insider had compromised its service. Emails claiming a 'security incident' urged users to 'Download Latest Version' of Trezor Suite from suite.xn--trzor-o51b[.]com. The fake app (Trezor-Suite-22.4.0-win-x64.exe, built from Suite's source code) asked for the 12 to 24-word recovery phrase and sent it to the attackers. | Trezor took the phishing domain offline, paused newsletters, and warned users not to open emails appearing to be from Trezor. | source |