# Trezor Safe 5 custody score: 78% | TradingAgentStack

> Trezor Safe 5 by Trezor (SatoshiLabs): custody score 78% from sourced facts on supply chain, key protection, signing, customer data and incidents.

Canonical: https://tradingagentstack.com/custody/trezor/

1. [Home](https://tradingagentstack.com/)

2. [Custody](https://tradingagentstack.com/custody/)

3. Trezor Safe 5

# Trezor Safe 5: custody score 78%

Trezor (SatoshiLabs) · Multi-asset · checked 2026-11-05. 66 of 85 points from sourced facts.

[Official store (trezor.io) →](https://trezor.io/)

## Score, input by input

| Input | What we found | Points | Source |
| --- | --- | --- | --- |
| Supply chain and authenticity Genuine-device check | In the app: Trezor Suite checks a factory-issued device certificate held in the secure element. | 10/10 | [source](https://trezor.io/learn/a/trezor-safe-device-authentication-check) |
| Supply chain and authenticity Official reseller list | Published: Authorized reseller list at trezor.io/resellers; Trezor is shrinking it, with dropped dealers' authorizations ending on January 1, 2027. | 5/5 | [source](https://trezor.io/resellers) |
| Supply chain and authenticity Tamper evidence | Strong: Ships without firmware (installed at setup) and with a holographic seal. | 5/5 | [source](https://trezor.io/learn/a/authenticate-trezor-safe-5) |
| Supply chain and authenticity Response to reseller incidents | Fast: Removed CryptoBilis on October 9, 2026, as a precaution, before any Trezor report. | 5/5 | [source](https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis) |
| Key protection Secure element | Certified (EAL): EAL6+ secure element. | 6/6 | [source](https://trezor.io/learn/a/authenticate-trezor-safe-5) |
| Key protection Open firmware | Open source: Firmware source is published. | 7/9 | [source](https://coldcard.com/compare/coldcard-vs-trezor/) |
| Signing safety Own screen to check what you sign | Yes: Color touchscreen with haptic confirmation. | 15/15 | [source](https://trezor.io/learn/a/trezor-safe-device-authentication-check) |
| Customer data exposure (36 months) Customer data | Partner breach: Aug 2026: shipping data leaked via fulfilment partner ShipMonk; Sep 2026: 347,149 marketing contacts exported at newsletter provider Brevo and used for phishing. | 5/15 | [source](https://bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers) |
| Incident record (24 months) Security incidents | Flaw, no losses: Oct 30, 2026: a credible, not yet examined report of an implant in a Safe 5 bought from CryptoBilis (no losses reported); June 2026: a lab laser attack on the Safe 7 needing the device in hand. | 8/15 | [source](https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis) |

## Incidents

- **2026-10-30** Implant reported in a Safe 5 bought from CryptoBilis in August 2026; not yet examined; no losses reported. [source](https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis)

- **2026-09-10** Brevo (newsletter provider) breach used to phish Trezor subscribers. [source](https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider)

- **2026-08-10** Customer shipping data leaked through fulfilment partner ShipMonk. [source](https://bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers)

## Where to buy safely

- Buy from the maker: [trezor.io](https://trezor.io/).

- Resellers: Authorized reseller list at trezor.io/resellers; Trezor is shrinking it, with dropped dealers' authorizations ending on January 1, 2027. [source](https://trezor.io/resellers) Its list names 86 shops in 46 countries (copied 2026-11-05); paste any shop into the [reseller check](https://tradingagentstack.com/custody/#reseller-check).

- Revoked: CryptoBilis (Ledger (sales halted Oct 9, 2026), Trezor (removed Oct 9, 2026) and OneKey (authorization ended Oct 12, 2026)). [source](https://therecord.media/ledger-cryptocurrency-wallet-implant-theft)

- On arrival: check the packaging, run the genuine-device check, and reject any device that already has a PIN or recovery phrase set.

Official links, known fakes and the full incident list: [TAS Check: Trezor (SatoshiLabs)](https://tradingagentstack.com/check/trezor-suite/).

## Keep it away from your bots

A hardware wallet is the vault. Don't connect it to a trading bot, an API key or an agent wallet: give the bot a separate trading float and sweep profits back to the vault's address. [How to split vault, float and sweeps](https://tradingagentstack.com/custody/#tiers). [Set up Trezor Safe 5 as cold storage, step by step](https://tradingagentstack.com/cold-storage/).

## Questions

### Is Trezor Safe 5 safe?

Trezor Safe 5 scores 78% on our custody score (66 of 85 points from sourced facts, checked 2026-11-05). Weakest point: Aug 2026: shipping data leaked via fulfilment partner ShipMonk; Sep 2026: 347,149 marketing contacts exported at newsletter provider Brevo and used for phishing.

### Has Trezor (SatoshiLabs) had a security incident?

Oct 30, 2026: a credible, not yet examined report of an implant in a Safe 5 bought from CryptoBilis (no losses reported); June 2026: a lab laser attack on the Safe 7 needing the device in hand.

### Where should I buy Trezor Safe 5?

From the maker's store (trezor.io). Resellers: Authorized reseller list at trezor.io/resellers; Trezor is shrinking it, with dropped dealers' authorizations ending on January 1, 2027. On arrival, run the genuine-device check and reject any device that already has a PIN or recovery phrase set.

## Other hardware wallets, scored
[OneKey Pro: 94%](https://tradingagentstack.com/custody/onekey/)[BitBox02 Nova: 89%](https://tradingagentstack.com/custody/bitbox/)[Blockstream Jade Plus: 79%](https://tradingagentstack.com/custody/blockstream-jade/)[CoolWallet Pro: 72%](https://tradingagentstack.com/custody/coolwallet/)[Foundation Passport Prime: 66%](https://tradingagentstack.com/custody/foundation-passport/)[Tangem Wallet: 66%](https://tradingagentstack.com/custody/tangem/)[Keystone 3 Pro: 54%](https://tradingagentstack.com/custody/keystone/)[Coldcard Q: 49%](https://tradingagentstack.com/custody/coldcard/)[Ledger Flex: 49%](https://tradingagentstack.com/custody/ledger/)

[All hardware wallets, scored](https://tradingagentstack.com/custody/) · [Is this seller authorized?](https://tradingagentstack.com/custody/#reseller-check) · [How we score](https://tradingagentstack.com/custody/#method)

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)