Trezor Safe 5: custody score 78%
Trezor (SatoshiLabs) · Multi-asset · checked 2026-11-05. 66 of 85 points from sourced facts.
Score, input by input
| Input | What we found | Points | Source |
|---|---|---|---|
| Supply chain and authenticity | In the app: Trezor Suite checks a factory-issued device certificate held in the secure element. | 10/10 | source |
| Supply chain and authenticity | Published: Authorized reseller list at trezor.io/resellers; Trezor is shrinking it, with dropped dealers' authorizations ending on January 1, 2027. | 5/5 | source |
| Supply chain and authenticity | Strong: Ships without firmware (installed at setup) and with a holographic seal. | 5/5 | source |
| Supply chain and authenticity | Fast: Removed CryptoBilis on October 9, 2026, as a precaution, before any Trezor report. | 5/5 | source |
| Key protection | Certified (EAL): EAL6+ secure element. | 6/6 | source |
| Key protection | Open source: Firmware source is published. | 7/9 | source |
| Signing safety | Yes: Color touchscreen with haptic confirmation. | 15/15 | source |
| Customer data exposure (36 months) | Partner breach: Aug 2026: shipping data leaked via fulfilment partner ShipMonk; Sep 2026: 347,149 marketing contacts exported at newsletter provider Brevo and used for phishing. | 5/15 | source |
| Incident record (24 months) | Flaw, no losses: Oct 30, 2026: a credible, not yet examined report of an implant in a Safe 5 bought from CryptoBilis (no losses reported); June 2026: a lab laser attack on the Safe 7 needing the device in hand. | 8/15 | source |
Incidents
- 2026-10-30 Implant reported in a Safe 5 bought from CryptoBilis in August 2026; not yet examined; no losses reported. source
- 2026-09-10 Brevo (newsletter provider) breach used to phish Trezor subscribers. source
- 2026-08-10 Customer shipping data leaked through fulfilment partner ShipMonk. source
Where to buy safely
- Buy from the maker: trezor.io.
- Resellers: Authorized reseller list at trezor.io/resellers; Trezor is shrinking it, with dropped dealers' authorizations ending on January 1, 2027. source Its list names 86 shops in 46 countries (copied 2026-11-05); paste any shop into the reseller check.
- Revoked: CryptoBilis (Ledger (sales halted Oct 9, 2026), Trezor (removed Oct 9, 2026) and OneKey (authorization ended Oct 12, 2026)). source
- On arrival: check the packaging, run the genuine-device check, and reject any device that already has a PIN or recovery phrase set.
Official links, known fakes and the full incident list: TAS Check: Trezor (SatoshiLabs).
Keep it away from your bots
A hardware wallet is the vault. Don't connect it to a trading bot, an API key or an agent wallet: give the bot a separate trading float and sweep profits back to the vault's address. How to split vault, float and sweeps. Set up Trezor Safe 5 as cold storage, step by step.
Questions
Is Trezor Safe 5 safe?
Trezor Safe 5 scores 78% on our custody score (66 of 85 points from sourced facts, checked 2026-11-05). Weakest point: Aug 2026: shipping data leaked via fulfilment partner ShipMonk; Sep 2026: 347,149 marketing contacts exported at newsletter provider Brevo and used for phishing.
Has Trezor (SatoshiLabs) had a security incident?
Oct 30, 2026: a credible, not yet examined report of an implant in a Safe 5 bought from CryptoBilis (no losses reported); June 2026: a lab laser attack on the Safe 7 needing the device in hand.
Where should I buy Trezor Safe 5?
From the maker's store (trezor.io). Resellers: Authorized reseller list at trezor.io/resellers; Trezor is shrinking it, with dropped dealers' authorizations ending on January 1, 2027. On arrival, run the genuine-device check and reject any device that already has a PIN or recovery phrase set.
Other hardware wallets, scored
All hardware wallets, scored · Is this seller authorized? · How we score