CryptoGuardzIndependent crypto register
Read the binding document, check it against the issuing register, publish the disagreement18+ · Gambling carries risk of loss

Choose a language

The register is published in these languages. If this page has no version in one of them, you go to that language’s home page.

Photo: Jason Dent / UnsplashWallet register · trezor.io

Is Trezor safe? What its terms and incident record say

No score publishedLast reviewed 3 recorded incidents
In short, from the documents

Is Trezor safe?

Trezor's terms place the keys with you and disclaim access to them. No party is disclosed as able to block an address. 3 primary-source incidents are recorded. Its terms name no gambling rule. Liability is capped at the fees paid for the app, and the purchase price for the device.

Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk

Trezor (Trezor Suite): keys held on a device you hold. Self-custodial, by the terms.Who holds the keysYouDeviceSharedProviderMarked: DeviceSelf-custodial, by the terms.Trezor (Trezor Suite): who can block an address: none disclosed in the documents read.Who can block an addressNobodyProviderThird partyMarked: NobodyNone disclosed in the documents read.Trezor (Trezor Suite): gambling clause: not disclosed, read 2026-10-07. The terms name no gambling rule, which is an absence, not a permission.Gambling clauseBannedSilentAllowedMarked: Silent, not disclosedThe terms name no gambling rule, which is anabsence, not a permission. Read 2026-10-07.Trezor (Trezor Suite): 3 primary-source incidents recorded.Incidents on record3incidentsOnly incidents a primary source records.
Trezor (Trezor Suite): keys held on a device you hold; who can block an address: none disclosed in the documents read; gambling clause: not disclosed; 3 primary-source incidents recorded. From its own terms, documents last checked . Not a rating. Drawn by the CryptoGuardz Register Desk from the record.

This page answers the short questions. The full Trezor entry quotes every clause behind them.

Disclosure: CryptoGuardz has no commercial relationship with Trezor (Trezor Suite) and earns nothing if you install it. Every statement below is read from a document Trezor (Trezor Suite) publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.

Trezor review: the documents

This is a review of the documents Trezor publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is Trezor Company s.r.o.; on jurisdiction the record says: Czech Republic. The custody position comes from the Trezor Suite Terms of Use, last updated 1 January 2026, read 2026-10-07. The record quotes 4 clauses across 3 topics, and 3 sub-service clauses where the app hands a swap, purchase or staking to another party. Trezor's terms place the keys with you and disclaim access to them. No cloud or hosted backup is offered; recovery depends on the copy you keep. Liability is capped at the fees paid for the app, and the purchase price for the device. Its terms name no gambling rule. 6 points could not be verified and are listed below.

Has Trezor been hacked?

3 incidents are recorded, each from a primary source: a disclosure by the company, a public vulnerability register or a regulator. The descriptions are the record’s, unedited, with the date and the source.

Incident · trezor.io

An unauthorised actor used Trezor's account at Brevo, its third-party email provider, to send emails to Trezor's marketing list; Trezor states 347,149 marketing email contacts were affected and no other Trezor system was touched. Funds are at risk only where a recipient entered a wallet backup into the malicious app the emails promoted.

An unauthorized actor gained access to Brevo's system and used it to send emails from various customer accounts, including Trezor's.

Date is the publication date of Trezor's post, updated 17 September 2026.

Retrieved 2026-10-07.

Incident · trezor.io

A data breach at ShipMonk, one of Trezor's shipping providers, exposed customer order data: full names, email addresses, phone numbers and shipping addresses. Trezor counts 80,689 customers affected, including about 67,000 US customers from November 2019 to August 2021, and states no Trezor system, product or service was affected.

ShipMonk, one of Trezor's shipping providers, has experienced a data breach that exposed sensitive customer order data.

Date is the publication date of Trezor's post, updated 4 September 2026.

Retrieved 2026-10-07.

Incident · blog.trezor.io

Unauthorised access to the third-party support ticketing portal Trezor uses. Trezor stated contact details (names and email addresses) of up to 66,000 people who had contacted Trezor Support since December 2021 were potentially exposed, and that no user funds were compromised through the incident.

unauthorized access to the third-party support ticketing portal we use

Trezor's post is dated 19 January 2024; the date recorded is the date of access it gives.

Retrieved 2026-10-07.

An incident on this list is a disclosed event, not a verdict on the product today. The absence of other incidents is not proof that none happened.

Trezor support and scams

The official domain in the record is trezor.io. The help pages this register read include Trezor support, is my coin supported. Type the domain yourself rather than following a link to it.

Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What Trezor stores, by the record: Nothing by Trezor, by the terms. The wallet backup is generated on the device and kept by the user.

Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like trezor.io, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back. The record shows 2 incidents that exposed customer contact details (dated above), which is the raw material for a message that knows your name. The record also describes an incident involving a malicious version or app (dated above).

If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.

What we could not verify

The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for Trezor nor against it.

  • The current Trezor Suite Services by Invity Terms of Use. The version at https://trezor.io/documents/terms_of_use_trezor_suite_services_by_invity.pdf (1 October 2022) returned 404; the 1 March 2022 version at data.trezor.io was read instead and may be superseded. Neither names the end Providers, and the 1 March 2022 version contains no KYC, refusal or freeze clause.
  • Whether the Suite terms contain any suspension, termination or sanctions clause. The retrieval found none; a full manual read of the PDF was not possible with the tools used.
  • What Trezor's own backend (Blockbook) servers receive, such as IP address and xpub, and whether Tor routing changes that. The privacy policy (last updated 16 March 2026) does not address it.
  • Whether CoinJoin remains available in Trezor Suite. It is not mentioned in the Suite terms.
  • Whether BNB Smart Chain, Base, Polygon and TON are natively supported in Suite.
  • An X (Twitter) account breach and a December phishing event referenced in Trezor blog and forum results were not read and are not recorded.

Analysis on Trezor and wallets

Ledger vs Trezor, compared on chips, open source, Ledger Recover, prices and coin supportLedger and Trezor both sell hardware wallets with certified secure elements. Ledger's chip code is closed under its agreement with STMicroelectronics and it sells Ledger Recover, an optional ID-based phrase backup; Trezor publishes its code and sells no comparable service on the pages read. US prices on 14 October 2026 run US$69 to US$399 for Ledger and US$59 to US$249 for Trezor.Solana wallets compared: Phantom, Solflare, Backpack, Ledger and Trezor on custody, fees, code and incidentsFive wallets that hold SOL were compared on what their own documents say. Only one, Backpack, puts a swap fee percentage in writing, and its blog contradicts it. Phantom's help centre said in September that its Google or Apple wallets split a key with Phantom; Solflare's terms say it never holds enough to move funds.What is a hardware wallet? What the chips do, what 8 devices cost, and where they failA hardware wallet is a dedicated device that holds the private keys and signs transactions away from the computer. Eight current Ledger and Trezor models list at US$59 to US$399 on their makers' shops, read 14 October 2026; the failures on record came from firmware, suppliers and phishing.How to set up a bitcoin wallet, step by step from the Blockstream and Trezor guidesA self-custody bitcoin wallet is set up by installing the app, generating keys, writing down a 12 or 24 word recovery phrase and checking it. Blockstream's app guide lists 4 steps; Trezor says its hardware setup takes about 15 minutes and wipes the device after 16 wrong PINs.Coinbase vs Coinbase Wallet: a custodial exchange account and a self-custody wallet, and the Base app renameCoinbase is a custodial exchange account where crypto is "stored on the platform"; Coinbase Wallet is a self-custody app where Coinbase "never has access to your recovery phrase". The wallet's App Store notes called it Base app for months, and since version 30.11 say "We're now Coinbase Wallet."How to buy Solana in the US: which exchanges list SOL, what they charge, and what moving it to a wallet costsCoinbase, Kraken, Robinhood, PayPal and Gemini each list SOL on their own pages, read on 14 October 2026; Cash App's crypto disclosures cover bitcoin and stablecoins, not SOL. Buy fees follow each platform's general crypto schedule. On-chain, Solana charges 5,000 lamports per signature, and the refundable rent-exempt minimum is being cut by up to 90% in five steps from September 2026.

Sources

Compiled by the CryptoGuardz Register Desk from the Trezor record, first published 2026-10-07, last reviewed 2026-10-07. Quotations are verbatim from the document named beside them. Corrections: corrections.