Trezor Safe 3 vs Safe 5: Is The Touchscreen Worth Paying For?

Where The Keys Reside

Both devices create the wallet locally. Trezor describes their OPTIGA Trust M V3 secure element as holding a secret that combines with the PIN to encrypt the private keys. Ledger's Donjon researchers place those encrypted keys and transaction signing on the main microcontroller, outside the secure element.

The secure element releases its secret after correct PIN entry. A reset follows sixteen incorrect entries, with the chip deleting its secret. The chip's CC EAL6+ certification concerns that component, rather than certifying every part of the wallet and its connected services.

Moving Away From Trezor

BIP39 and SLIP39 backups provide routes to compatible devices or software. A replacement needs support for the format, passphrase and account types holding your assets. A BIP39-only restore cannot accept a 20-word SLIP39 backup.

A usable backup restores access without the original PIN, but support cannot recreate missing recovery material. Optional trades and staking can introduce provider custody or contract dependence beyond this base wallet design.

Physical Research Needs A Model Boundary

Ledger's Donjon team published a Safe 3 firmware-tampering demonstration in March 2025. It targeted an STM32F429-based device and bypassed authenticity and firmware-hash checks. The recovered pairing secret was not the owner's wallet backup, and the experiment did not demonstrate extraction of a locked owner's seed or PIN.

Donjon described how altered firmware could manipulate randomness and enable later theft. Trezor acknowledged the bypasses and said Safe 5 was unaffected because of its newer microcontroller. Ledger is a competing manufacturer, and its researchers identified Safe 5's different STM32U5 chip without demonstrating that attack against it.

Safe 3 has two documented revisions, T2B1 and T3B1, with a post-release chip upgrade in the latter. Store metadata does not guarantee the revision shipped. Ask Trezor about a particular unit before applying the older hardware finding to it.

Read The Device Approval

Both products support Trezor's September 2026 Clear Signing feature with updated standard firmware. Trezor says supported Ethereum and EVM contracts can show readable actions, amounts and destinations on the device through Suite, WalletConnect or Trezor Connect. Coverage requires an appropriate ERC-7730 contract descriptor.

Unsupported contracts retain the blind-signing warning. A readable approval also leaves you responsible for deciding whether the contract and requested permissions are acceptable. Safe 5 shows that information on a larger color screen, without establishing a measured reduction in scams or mistakes.

Code And Additional Controls

Trezor's GPLv3 license covers the core firmware, while other repository components have separate licenses. Ledger's researchers describe OPTIGA's software as closed. The app has a different restriction: its Trezor Reference Source License allows reference use within a company, but not distribution beyond it. Unrestricted open-source access does not extend across the entire system.

Trezor publishes build-verification instructions and operates a bug bounty for devices, applications and infrastructure. Neither constitutes a guarantee that the currently installed firmware has no flaws. Safe 5 also offers optional microSD access protection, discussed below, while both retain secure-element PIN enforcement.

Restore The Wallet, Not The Old PIN

After device loss or damage, restore the correct backup on compatible hardware, then open any passphrase wallet with its exact passphrase. A forgotten PIN requires a wipe and restore, so check your backup before erasing a working device. A backup exposed to someone else calls for a new wallet and a transfer of funds, not restoration of the compromised secret.

Current Safe 3 and Safe 5 setups default to a 20-word SLIP39 backup. Older Safe 3 units can start with a 12-word BIP39 default, and both support legacy BIP39 recovery. Moving to Safe 5 therefore does not require abandoning an existing supported backup.

With SLIP39, recovery can depend on a single share or a chosen minimum from several shares. For example, two shares belonging to a three-share set can restore it. This is a backup arrangement, not transaction co-signing. Separate the shares geographically without making the required minimum inaccessible to the intended recovery person.

Changing A Backup Arrangement

Newer SLIP39 multi-share backups require compatible recovery software, including Trezor firmware 2.7.2 or later. Creating another backup set does not invalidate an older usable set. Shares from separate sets cannot be mixed to meet a threshold.

Suite does not convert BIP39 to SLIP39. Trezor discourages its advanced command-line conversion and recommends creating a new wallet and transferring funds instead. Its guidance also requires a new wallet when changing the backup arrangement for SLIP39 backups created before June 2024.

A passphrase adds another recovery secret on either device. Case and spaces matter, and a mistyped passphrase can open a different, empty wallet. Keep an offline record separately from the device and backup. Trezor cannot reset it.

Safe 5's Card Has A Different Job

Optional microSD protection puts an additional unlocking secret on a card. Once enabled, Safe 5 requires the paired card and PIN for access. Setup uses a FAT32-formatted card and Trezor's trezorctl command-line tool, version 0.11.6 or later.

The card contains no wallet backup. Losing it requires restoration from the actual backup and any passphrase. Enabling this control adds separate card storage and retrieval to your routine.

Main Accounts And Firmware Choices

Both devices support Bitcoin, Ethereum, Solana, Cardano and XRP accounts through Trezor Suite. The standard firmware provides the non-Bitcoin functions. Bitcoin-only firmware excludes those functions on both models, so the installed firmware matters more than the touchscreen for this choice.

Check the chain, account and token contract before withdrawing from an exchange. Similar-looking addresses are not proof that Suite supports the intended deposit route.

The Safe 3 wallet review covers its supported-account and setup choices in more detail. Paying for Safe 5 does not change which of the main accounts compared here you can manage through Suite.

Connecting To Applications

Suite's desktop settings manage WalletConnect sessions and applications using Trezor Connect. Hardware-signature requests still need compatibility with the specific app, chain and transaction type.

Solana account management is native to Suite, while compatible apps such as NuFi provide Solana dApp access. Check the model and intended function before funding it. Displaying an account does not prove a contract interaction will work.

Buttons Or Touch Input

Safe 3 combines two buttons with a 0.96-inch monochrome OLED at 128 × 64 pixels. Safe 5 has a 1.54-inch color touchscreen at 240 × 240 pixels, haptic feedback and Gorilla Glass 3. Its touchscreen handles PIN entry, passphrases and T9-style recovery-word selection.

Safe 3 also accepts these secrets on the device, using button navigation. Both keep recovery-word entry off the computer. Frequent passphrase entry gives touch controls a recurring use, while occasional transfers may not justify their cost.

The Safe 5 touchscreen review explains its controls and optional card setup. Neither model has demonstrated superior accessibility or fewer input errors here. Check that you can read the approval display comfortably.

USB Setup And Phone Limits

USB-C connects either device to a compatible computer or Android phone. Each includes a USB-C-to-USB-C cable, so a USB-A-only computer needs a compatible cable or adapter. Safe 3 weighs 14 g, compared with Safe 5's 23 g.

New devices arrive without firmware. Suite guides installation and authenticity checks before wallet creation, backup and PIN setup. Stop if packaging or setup requests appear suspicious, even if a software check succeeds. Obtain the application through Trezor's official website.

Trezor excludes swaps, sending, setup and device management from its iOS support. Neither device connects to an iPhone for signing, even through a USB-C port, so neither suits iPhone-only transaction approval.

Support And Purchase Protection

Both use Trezor's documentation and support channels, beginning with its Hal assistant for help requests. The June 16, 2026 shop terms state a two-year commercial warranty for defects under normal use. Their consumer withdrawal provisions specify 15 days, with sealed-packaging and condition restrictions. Check the contract applying to your order, especially when buying from a reseller.

The $70 Purchase Difference

On September 12, 2026, Trezor's US offers listed Cosmic Black Safe 3 at $59 and Black Graphite Safe 5 at $129. Applicable delivery, taxes or import charges affect the checkout total. Safe 5's optional microSD card and metal backups for either model add to the purchase cost.

There is no subscription charge for managing wallets in Suite, although transfers require payment to the network. Safe 5's price does not include a demonstrated discount on those fees or on a provider's exchange quote.

Trading Through Providers

Both access Suite's integrated services, including Banxa and MoonPay purchase offers, Changelly and ChangeNOW centralized swaps, and 1inch or LI.FI decentralized routes. Availability and identity checks depend on the provider, location, payment method and asset.

Centralized swaps send the input assets to the provider for processing. Refund handling can also involve identity checks. A 1inch or LI.FI route uses contract permissions, with an exact-amount allowance or an unlimited allowance that permits future access to that token balance. Hardware approval does not cancel the permission afterward.

Compare the final amount received and separately displayed network costs before signing. A slippage setting controls how far the execution price may move from the quote. It is not itself a service fee.

Staking Costs And Access

As of September 12, Trezor lists a 7% Everstake commission on SOL rewards and a 10% commission on ETH rewards. Those percentages are not promised returns or fees on the entire staked principal. SOL staking has activation and cooldown periods, while ETH withdrawals depend on the staking system's processing.

Everstake's contracts and infrastructure handle Suite's ETH staking. According to Trezor's risk disclosure, failure of that provider could leave the stake unrecoverable. ADA delegation instead has a refundable 2 ADA registration deposit, network fees and applicable pool terms, while delegated account funds remain spendable. Partner eligibility and service terms still apply to both devices.

Suite Controls Apply To Both

Suite connects to Trezor-operated blockchain servers by default. Users can choose a custom Blockbook backend for supported coins or an Electrum server for Bitcoin. That changes who handles the blockchain queries, provided the chosen server is reachable and maintained.

The desktop app also offers Tor and optional usage-data sharing. According to Trezor's analytics documentation, IP addresses reach AWS and Sentry but are stripped from Trezor's logs. Error reports have a stated 90-day retention period. Performance records may remain longer. These are company disclosures, not an independent traffic audit.

Turning off diagnostics does not hide blockchain transfers or erase payment-provider records. Trezor's shopping-data summary also allows longer retention for unresolved orders and invoices.

Recent Provider Incidents

The ShipMonk shipping-data breach expanded to cover roughly 67,000 additional US customers in Trezor's September 4, 2026 disclosure. Older orders exposed names, contact details and delivery addresses, despite previous assurances of deletion. The Block independently covered the update. Trezor distinguished the provider breach from its own infrastructure and hardware, which it said were not compromised.

On September 10, Trezor identified Brevo as the newsletter provider behind the previous day's phishing campaign. Roughly 347,000 subscribers received a fake STM32 vulnerability alert. Trezor said it suspended the provider account and warned subscribers, but could not confirm whether the address list had been exported. SecurityWeek corroborated the campaign and reported that the extent of any fund losses was unclear.

The fake alert sought wallet backups through a malicious app. It was not proof of a new chip vulnerability. An email or purported support agent asking for recovery words is a reason to stop, not to disclose them. Both Safe models share this customer-communications exposure, regardless of their approval interface.

Safe 3 launched on October 12, 2023, and Safe 5 on June 14, 2024. Their model-specific firmware records remain active. On September 12, both Safe 3 revision logs and Safe 5's log listed version 2.12.4, dated August 19, 2026.

July's 2.12.2 included Solana and Bitcoin signing or confirmation fixes. Safe 5's 2.12.1 release, dated June 17, 2026, also fixed device locking when only SD protection was enabled. These entries record patch history. They are not evidence that an owner's wallet was exploited.

Trezor publishes reproducible-build instructions for Safe 3's T2B1 and T3B1 variants and Safe 5's T3T1. Install the official update for the connected model, not another device's firmware with the same version number.

Trezor's product pages, device FAQs and shop terms give no guaranteed firmware-support deadline for either model. The hardware warranty is a separate promise from ongoing software maintenance. Safe 5's later launch does not establish a longer remaining support period.

Compatible third-party interfaces can reduce dependence on Suite for supported accounts. A spare device still cannot replace a backup if both devices are lost together.