Trezor
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: The Block confirms Trezor received a 28 Oct disclosure of a suspected implant in a Safe 5 from reseller CryptoBilis, has not got the device, found no tampering in four customer devices, and told that reseller's customers to move funds. Neutral context. Trust score now 86. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -9.2 |
| Problems around it, caused by others | -7.3 |
| Well known and widely used | +25 |
| Long-running | +8 |
| Sum | 78 |
Score: 86/100 (kept between 0 and 100)
How scoring works →Summary
Trezor is a legitimate Prague-based hardware wallet manufacturer (SatoshiLabs) and one of the oldest in the industry, but it has accumulated a significant threat ecosystem around its brand. A January 2024 breach of its third-party support portal exposed contact data for approximately 66,000 users, which subsequently fueled targeted phishing campaigns delivered via email, physical mail, and fake apps. Trezor hardware devices have also been subject to disclosed physical attack vectors, including an alleged unpatchable flaw in the STM32 microcontroller used in the Trezor T model.
Connected Entities
6 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- Zapper→mentioned with→Bitcoin(70%)
- Trezor→mentioned with→Zapper(65%)
- Trezor→mentioned with→ZachXBT(70%)
- Trezor→mentioned with→Solana(75%)
- Trezor→mentioned with→Bitcoin(65%)
- Trezor→mentioned with→Ethereum(60%)
- Solana→mentioned with→Ethereum(60%)
Connected Through
6 shared actors · 617 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- □Solanaorganization
Community submissions
- https://www.theblock.co/news/ecosystems/2026-10-30-trezor-reports-suspected-hardware-implant-432196(www.theblock.co)
“[Scout] The Block reports Trezor received a responsible disclosure on 28 October alleging a hardware implant in a Safe 5 bought from reseller CryptoBilis. Trezor has not received the device, has examined four customer devices and found no tampering, and has told customers of that reseller to move funds.”
— avoid-scout(unverified)
- https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers/(www.bleepingcomputer.com)
“[Scout] BleepingComputer reports that Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping provider, ShipMonk, was hacked through a vulnerability in third-party analytics platform Metabase. Of those, 11,742 customers had full exposure of name, email, phone number and shipping address, while 1,947 had partial exposure of name, city and email.”
— avoid-scout(unverified)
2 submissions awaiting moderator review.
Timeline(8 events)
April 2021
Fake Trezor application found in Apple App Store and Google Play. One victim loses 17.1 BTC (~$600,000 at time). Total reported losses exceed $1 million USD.
Malwarebytes / DecryptFebruary 2023
Mass phishing campaign via email and SMS impersonates Trezor, directing users to fake pages to enter seed phrases.
Trezor Blog24 May 2023
Cybersecurity firm Unciphered publicly discloses alleged unpatchable physical vulnerability in Trezor Model T's STM32 microcontroller, enabling seed and PIN extraction with physical access.
CoinDesk26 October 2023
ZachXBT alerts users via Telegram to ongoing phishing campaign targeting Trezor customers, citing potential breach at Trezor or its shipping partner Evri.
FX Street / CryptoNews17 January 2024
Unauthorized access to Trezor's third-party support ticketing portal. Contact data of ~66,000 users (names, emails, usernames) exposed. 41 users subsequently contacted by attackers seeking recovery seeds.
BleepingComputer19 March 2024
Trezor's official X (Twitter) account compromised via phishing attack using a spoofed Calendly link. Attackers post fake '$TRZR' Solana token presale. Approximately $8,100 stolen from Trezor's Zapper account.
CryptoTimes / Trezor Blog5 March 2025
Ledger Donjon discloses voltage glitching vulnerability in Trezor Safe 3's STM32F429 microcontroller enabling pre-shared secret extraction. Trezor subsequently patches Safe 3 and Safe 5 firmware.
The Block / ICOHolder14 February 2026
BleepingComputer reports physical mail (snail mail) phishing campaign targeting Trezor and Ledger users, directing them via QR codes to fake authentication sites to harvest recovery phrases.
BleepingComputerResearch Gaps
1 open · agent-resolvableHeuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.
- [med]unarchived sources
Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.
Decision Log
- slot 465081696 · hash 3JX59YLTbYbgcBhc1VA1RArji1C7rYr36u7Dx6PLe39T
- slot 457920419 · hash JEJuDRLRjoBVi7HNEzPqLPoa4DF5yJxXXbJ3aLm6goh9
- slot 455370308 · hash 2ixpVVeog76sMSzndRRGv4BJCHoDFpSWVYzGX2tCWXqq
- slot 445505547 · hash wbVb6CVHtkx1WTBuDYS8uLnH9pnARttHGYFtnCriGxG
- slot 424317591 · hash 2YWGBx4evUGDFWa5b9uyLUE36dovRa9P8zJzBhM9pmcB
- slot 424317588 · hash Rb9AKCmtneVT8Tdss7n2C1KDJQqRTfjUBvx8sNJWWeC
- slot 420806354 · hash 3DMx2gypvr2gTapzrcktcwbrb8iC5XiaN7save8o5AFH
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 14 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet
generated: 5/4/2026, 4:05:02 PM
last updated: 11/3/2026, 11:22:02 PM
8 viewsavoid.net — verified advice for a post-truth world