# Is Trezor Suite safe to connect? | TradingAgentStack

> Trezor Suite: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-26.

Canonical: https://tradingagentstack.com/check/trezor-suite/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Trezor Suite

# Is Trezor Suite safe to connect?

Self-custody wallet · Bitcoin, Ethereum, Other coins supported by Trezor devices. Checked 2026-10-26; every line links its source.

**Worst case:** Trezor Suite is self-custody, so no one can freeze your coins, but anyone who gets your recovery seed can empty every account it backs up, and that cannot be reversed. Fake Trezor Suite downloads (2022) and phishing built on leaked support and shipping data (2024, 2025, 2026) are designed to get that seed.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Download Trezor Suite only from trezor.io/trezor-suite or github.com/trezor/trezor-suite/releases (mobile: App Store id1631884497 or Google Play io.trezor.suite), and check the desktop installer's GPG signature against the 'SatoshiLabs 2021 Signing Key' (fingerprint EB48 3B26 B078 A4AA 1B6F 425E E21B 6950 A2EC B65C), as Trezor's download guide explains

2. Never share your recovery seed or make a digital copy of it. Trezor will never contact you about it, so treat any email (even one from help@trezor.io), call, letter or 'vault'/'update' link that asks for it as phishing, and reach support only via trezor.io/support

3. Verify every address and amount on the Trezor's own screen, not just on your computer, before confirming, as Trezor's scams-and-phishing guide advises

## What it can do with your money

| Who holds the keys | You hold the keys Self-custody. Trezor Suite is the companion app for Trezor hardware wallets; Trezor says you keep 'full control of your private keys' and that crypto 'is not stored on your Trezor' (it lives on the blockchain, and the device holds the keys). Your recovery seed restores everything, and Trezor says it will never contact you about it. [source](https://trezor.io/trezor-suite) |
| --- | --- |
| Can funds be sent out to any address? | Yes. You confirm every send on the device yourself, to any address. Anyone with your recovery seed can do the same from another device, and nobody can reverse it. [source](https://trezor.io/learn/security-privacy/personal-security-standards/scams-and-phishing) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `trezor.io`

- X: `@trezor`

- GitHub: `github.com/trezor`

- GitHub: `github.com/trezor/trezor-suite`

- App: `https://apps.apple.com/app/id1631884497`

- App: `https://play.google.com/store/apps/details?id=io.trezor.suite`

Where we confirmed these
- https://trezor.io/trezor-suite (vendor page: links App Store id1631884497, Google Play io.trezor.suite, github.com/trezor, twitter.com/trezor; footer Reddit r/TREZOR, Instagram, Facebook, TikTok, YouTube; no Telegram or Discord)

- https://trezor.io/guides/trezor-suite/download-verify-trezor-suite (vendor: download only from trezor.io/trezor-suite or github.com/trezor/trezor-suite/releases; web version at suite.trezor.io/web; GPG verification with 'SatoshiLabs 2021 Signing Key', fingerprint EB48 3B26 B078 A4AA 1B6F 425E E21B 6950 A2EC B65C)

- https://trezor.io/learn/security-privacy/personal-security-standards/scams-and-phishing (vendor: official domains trezor.io, invity.io, vexl.it, tropicsquare.com, satoshilabs.com; social twitter.com/trezor and instagram.com/trezor.io)

- https://apps.apple.com/us/app/trezor-suite/id1631884497 ('Trezor Suite', seller Trezor Company s.r.o., developer website https://trezor.io/, v26.9.3)

- https://play.google.com/store/apps/details?id=io.trezor.suite&hl=en_US ('Trezor Suite', developer Trezor Company s.r.o., website https://trezor.io, email help@trezor.io, 100K+ downloads, updated 2026-07-22)

- https://github.com/trezor (GitHub org 'Trezor', verified domain trezor.io, website https://trezor.io, links twitter.com/trezor; trezor/trezor-suite monorepo links trezor.io/trezor-suite)

- https://www.techrepublic.com/article/phishing-attacks-trezor-wallets/ (third-party, 2022-04-05: legitimate Trezor Suite domain suite.trezor.io) and https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/ (legitimate site trezor.io)

### Known fakes

- `suite.xn--trzor-o51b.com` · 2022-04-03 [source](https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/)

- `trezorwallet.org` · 2022-04-03 [source](https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/)

- `trezor.us` · 2022-04-03 [source](https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/)

- `suite.trezoriovpjcahpzkrewelclulmszwbqpzmzgub37gbcjlvluxtruqad.onion` · 2022-04-03 [source](https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/)

- `vault.trezor.guide` · 2025-06-24 [source](https://www.bleepingcomputer.com/news/security/trezors-support-platform-abused-in-crypto-theft-phishing-attacks/)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2026-08-10 | Customer shipping data leaked through Trezor's fulfilment chain: Metabase told fulfilment partner ShipMonk on 2026-08-06 of unauthorized access, and ShipMonk told Trezor on 2026-08-10. 13,689 customers who ordered between 2026-05-10 and 2026-08-08 were affected: 11,742 had full name, email, phone number and shipping address exposed, and 1,947 had name, city and email exposed (US, UK, Sweden, Colombia, Brazil, Italy, Portugal). |  | Trezor says its own systems and devices were not compromised and warned of phishing by email, phone and letter. No loss of funds reported. | [source](https://bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers) |
| 2025-06-24 | Reported date: attackers abused Trezor's support contact form, opening tickets whose titles were phishing messages. Trezor's automatic reply then came from the real help@trezor.io, carrying lines such as '[URGENT]: vault.trezor.guide - Create a Trezor Vault now...' that led to a page asking for the wallet seed. (third-party report) |  | Trezor warned users on X, repeated that it never asks for the seed, and said it was working on defenses | [source](https://www.bleepingcomputer.com/news/security/trezors-support-platform-abused-in-crypto-theft-phishing-attacks/) |
| 2024-01-17 | Unauthorized access to a third-party support ticketing portal used by Trezor (detected 2024-01-17, 20:20 CET). Names or nicknames and email addresses of up to 66,000 people who contacted Trezor Support since December 2021 may have been exposed. The attacker emailed 41 of them asking for their recovery seed. |  | Trezor says no user funds were compromised and no seeds were disclosed. It alerted the 41 users within an hour and emailed everyone potentially affected on 2024-01-20. | [source](https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8) |
| 2022-04-03 | Phishing through Trezor's MailChimp-hosted newsletter: MailChimp told Trezor an insider had compromised its service. Emails claiming a 'security incident' urged users to 'Download Latest Version' of Trezor Suite from suite.xn--trzor-o51b[.]com. The fake app (Trezor-Suite-22.4.0-win-x64.exe, built from Suite's source code) asked for the 12 to 24-word recovery phrase and sent it to the attackers. |  | Trezor took the phishing domain offline, paused newsletters, and warned users not to open emails appearing to be from Trezor. | [source](https://www.bleepingcomputer.com/news/security/fake-trezor-data-breach-emails-used-to-steal-cryptocurrency-wallets/) |

## Check a link

Got a link, @handle or repo that claims to be Trezor Suite? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Trezor Suite

We email you if we add an incident, a freeze report, a known fake or a deadline for Trezor Suite. Free; unsubscribe anytime.

## More checks: Wallets
[Phantom](https://tradingagentstack.com/check/phantom/)[MetaMask](https://tradingagentstack.com/check/metamask/)[Rabby Wallet](https://tradingagentstack.com/check/rabby/)[Trust Wallet](https://tradingagentstack.com/check/trust-wallet/)[Exodus](https://tradingagentstack.com/check/exodus/)[Backpack](https://tradingagentstack.com/check/backpack/)[Solflare](https://tradingagentstack.com/check/solflare/)[Coinbase Wallet](https://tradingagentstack.com/check/coinbase-wallet/)[Electrum](https://tradingagentstack.com/check/electrum/)[Keystone](https://tradingagentstack.com/check/keystone/)[Ledger Live (now Ledger Wallet)](https://tradingagentstack.com/check/ledger-live/)[OKX Wallet](https://tradingagentstack.com/check/okx-wallet/)[Bitget Wallet](https://tradingagentstack.com/check/bitget-wallet/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)