Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data. This affects new customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who received an order within the 90 days prior to August 8th, 2026.

The data exposed:

• Full names
• Shipping addresses
• Phone numbers
• Email addresses

The incident affects 11,742 customers with full exposure (name, email, phone number, shipping address) and 1,947 customers with partial exposure (name, city, email). The breach is limited due to Trezor’s strict 90-day data storage policy (we were also able to negotiate the same terms with fulfillment partners, who follow the same policy).

All affected customers have been contacted separately by email.

Our systems and devices remain secure, but affected customers could experience an increase in phishing attempts.

NEVER enter your wallet backup on a website or share it with anyone, and only check for updates on official Trezor channels.

We are deeply sorry to the community and those affected.

We are investigating this situation and will post updates on our blog: https://t.co/JGrttMs4Ev

Scammers are getting smarter by the day. However, always VERIFY what you receive in your email and from WHO.

ANY UPDATES THAT ARE NEEDED CAN BE DONE AUTOMATICALLY IN THE TREZOR SUITE

Since we are seeing a lot of people now integrating Passphrases, we thought it would be best to post this one too. Below is the text based FAQ

Passphrase FAQ: key points

• A passphrase is an optional extra secret added to your wallet backup.
• Your wallet backup alone opens your standard wallet.
• Your wallet backup plus a passphrase opens a completely separate wallet.
• Every unique passphrase creates a valid wallet, including typos, different capitalization, or extra spaces.
• Passphrases cannot be changed or removed from an existing wallet.
• Trezor does not store your passphrase, and Trezor Suite cannot recover it.
• Losing either the wallet backup or the passphrase means losing access to the passphrase wallet.
• Most users do not need a passphrase. Trezor recommends considering SLIP39 multi-share backup as a simpler option for strengthening backup security.
• Passphrases are best suited to advanced users who understand the added responsibility and have a specific security need. (Trezor)

How to store and test a passphrase

• Write it down exactly, including spaces, capitalization, numbers, and special characters.
• Store it physically on paper or metal.
• Do not rely on memory alone.
• Avoid easily confused characters such as 1, I, l, 0, and O.
• Keep it separate from your wallet backup if you are concerned about someone finding both.
• Do not store it in photos, cloud storage, or ordinary digital notes.
• Record a wallet identifier, such as the last five characters of the first receiving address, to confirm you opened the correct wallet.
• Test the passphrase before depositing significant funds by sending a small amount, closing the wallet, and reopening it using your written copy. (Trezor)

Choosing a strong passphrase

• A strong passphrase must come from genuine randomness.
• Human-created phrases, meaningful words, dates, quotes, and keyboard patterns are usually predictable.
• Attackers may use dictionaries, leaked passwords, personal information, and common substitution patterns.
• Four random Diceware words provide about 51 bits of entropy, which may be vulnerable to a well-funded attacker.
• Six random Diceware words provide about 77 bits and are considered well beyond practical brute-force attacks.
• A random 10-character string using mixed characters can also be strong, but may be harder to record accurately.
• Good generation methods include physical Diceware rolls or a reputable password manager’s random generator. (Trezor)

Recovery and compatibility

• Passphrases work with compatible BIP39 and SLIP39 wallets.
• The same wallet backup and exact passphrase should recreate the same wallet in compatible software.
• If your Trezor is lost, you need both the wallet backup and exact passphrase to restore access.
• A passphrase is not necessary just to create another account. Use the Add account feature in Trezor Suite instead.
• Anyone with both your wallet backup and passphrase can access the funds.
• Long-term holders should include the passphrase in their inheritance or emergency-access planning. (Trezor)

Main takeaway

• A passphrase can add meaningful security, but it also creates another way to permanently lose access.
• Write it down, store it securely, and test it before using the wallet for significant funds.
• Consider whether SLIP39 multi-share backup could provide the protection you need with less risk. (Trezor)

Coldcard vulnerability: Trezor devices are not affected FAQ

On July 30, 2026, Coinkite disclosed a vulnerability affecting wallets generated by certain Coldcard firmware versions.

Trezor devices are not affected.

If your wallet was originally generated on a Trezor, your funds are safe and no action is required.

Who may need to take action?

You may be affected if:

• Your wallet was originally generated on an affected Coldcard device
• You later restored that same wallet backup on a Trezor

Restoring a wallet backup on a different device does not change the keys behind it. If the original wallet was generated with weak randomness, moving the same backup to Trezor does not fix the problem.

In that case, generate a completely new wallet on your Trezor and move your funds to addresses controlled by the new wallet.

Why Trezor is not affected

Trezor does not use Coldcard firmware or code.

Trezor generates wallets using multiple independent sources of randomness:

• Randomness generated by the Trezor device
• Randomness from the connected computer or phone
• Additional Secure Element entropy on Trezor Safe models
• Four entropy sources on Trezor Safe 7, including TROPIC01

Trezor also uses Entropy Check to verify that wallet generation is working as expected.

All Trezor models generate at least 128-bit entropy under default settings.

Are older Trezor models still safe?

Yes.

Trezor Model One and Model T remain safe to use. They combine randomness from the device and the connected host.

Trezor Safe 3 and Trezor Safe 5 add entropy from the Optiga Secure Element.

Trezor Safe 7 also includes the TROPIC01 chip and combines four independent entropy sources.

Do Trezor users need to regenerate their wallets?

No.

Keep your firmware and Trezor Suite up to date, but this Coldcard incident does not require users to regenerate wallets originally created on a Trezor.

Only users who imported a potentially affected Coldcard-generated wallet should create a new wallet and migrate their funds.

If I send funds to a new Trezor wallet, are they safe?

Yes.

Once the transaction is confirmed and the receiving address belongs to a completely new wallet generated on the Trezor, the funds are no longer controlled by the affected Coldcard-generated keys.

Simply restoring the old wallet backup on a Trezor is not enough.

Stay alert for scams

Security incidents often lead to phishing campaigns designed to create fear and urgency.

Please remember:

• Never share your wallet backup
• Never type your wallet backup into a website, form, app, email, or message
• Only enter your wallet backup as instructed on your Trezor device
• Trezor will never contact you asking for your wallet backup
• Do not follow wallet migration instructions from unsolicited emails, messages, or phone calls

The key takeaway:

If your wallet was generated on a Trezor, you are not affected and no action is required.

If your wallet was generated on an affected Coldcard and later restored on a Trezor, create a new wallet on your Trezor and migrate your funds.

The recent Coldcard issue is limited to their own custom firmware and how some of their devices generated randomness. Trezor does not share that code.

We have always mixed multiple independent sources of randomness together (device hardware + host + secure elements on newer models). We are truly sorry for everyone who has lost bitcoin.

Stay safe.

Read more on how Trezor generates entropy here:https://t.co/Nj6xveBQJk

Important note:

If you generated your seed on an affected Coldcard and later moved it to a Trezor, you are still affected. The seed was created with weak randomness on the Coldcard, restoring it elsewhere does not fix that. Please generate a fresh seed on your Trezor and carefully move your funds.

Hello everyone,

I am looking to create a small team on here for a secret mission. Only active users will be chosen for it :)

Drop a comment if you are interested

Heya everyone,

we are doing a clean up of the Sub from scammers,

if you are contacted by these such morons, please DM a screenshot of your convo with them.

We are also trying to actively take down their websites too in the process (which we are very efficient at).

Much thanks for helping keeping the space clean and safe

Hi guys. Recently found very old recovery seed with lots in bitcoin, needing new device. Had a ledger but it broke. I’m thinking of switching to trezor. Is there anything I should know when setting up this device? Or do I just input my seed from my old ledger and it’s safe?

Newbie question, thanks