Trezor Safe 3 Wallet Review

The Safe 3 fits self-custody users who want a certified-chip cold wallet at the lowest credible price and are willing to run a passphrase.

• Get it if you hold mainstream coins, use a desktop or Android phone, and want firmware you or anyone else can inspect.
• Get it if you're moving off an exchange for the first time and want the cheapest serious device from a vendor with a 2014-to-now record.
• Skip it if your phone is an iPhone and you need to send on mobile.
• Skip it if you hold amounts you won't protect with a passphrase. In that case pick a device that signs inside the secure element.
• Skip it if you want a touchscreen or air-gapped QR signing, neither of which exists at this price from Trezor.

The Safe 3 is the entry model in Trezor's current Safe line, sitting under the touchscreen Safe 5 and the flagship Safe 7. It launched in 2023 at $79 and now sells for $59, which makes it the cheapest current-generation hardware wallet with a certified secure element from a first-tier vendor.

SatoshiLabs, the Prague-based company behind it, built the first hardware wallet in 2014 and co-authored the BIP39 seed-phrase standard that nearly every wallet on the market now uses. That track record is a genuine trust signal. The company has never lost customer funds from its own infrastructure, though its brand has been a repeated phishing target, covered below.

The Safe 3 is fully non-custodial. Keys are generated on the device, never leave it, and every transaction requires physical confirmation on the two hardware buttons. There is no Bluetooth and no battery. The only way in is the USB-C port.

The chip layout is where precision is required. The Safe 3 pairs an Infineon OPTIGA Trust M (V3) secure element, certified CC EAL6+, with an STM32F4 general-purpose microcontroller. The secure element protects the PIN and the seed at rest. Cryptographic operations, including transaction signing, execute on the STM32F4. That split is the source of the device's one disclosed flaw.

The March 2025 Donjon Disclosure

Ledger's in-house security team showed that an attacker who physically obtains a Safe 3, desolders the microcontroller, and applies voltage glitching with specialist equipment can extract the seed, because the signing path runs on the STM32F4 outside the secure element's protection. Trezor confirmed the finding and shipped a firmware mitigation, but because signing runs on the microcontroller the exposure is architectural, not something firmware fully removes on this hardware. Three things keep it from sinking the device. First, it requires possession of the unit, so remote funds are never at risk. Second, it takes lab-grade gear and skill, not a screwdriver. Third, an optional passphrase defeats it completely, since the extracted seed alone opens nothing. The practical consequences are two: set a passphrase, and buy directly from Trezor so a tampered unit never reaches you.

Earlier Trezor marketing, and plenty of reviews echoing it, framed the Safe 3 as a device that cuts no corners on security. That framing does not survive the disclosure. The accurate statement is that the Safe 3 has a well-built at-rest security model and a signing path with a known, physically-gated, passphrase-mitigated extraction attack.

Open-source

Trezor's firmware and hardware designs are published and independently auditable, which remains the company's core differentiator against Ledger's closed operating system. The OPTIGA secure element, however, is a proprietary Infineon component. The correct label is partially open: open firmware on the MCU, closed silicon in the SE. It is worth noticing that the open chip is the one where the flaw was found and the closed one is where it wasn't, which cuts against the reflex that open automatically means safer at the silicon level.

Company Incident History

Trezor has never suffered an on-chain loss of user funds, but its support channels have been breached twice. In 2022, attackers used a compromised MailChimp account to send convincing phishing emails to Trezor's newsletter list. In January 2024, a support-portal breach exposed the names and email addresses of roughly 66,000 users. Neither incident touched keys or devices. Both feed the same realistic threat for Trezor owners: emails impersonating Trezor support asking for your seed. The device will never need your seed typed anywhere but its own screen flow, and no legitimate support message will ask for it.

Versus Ledger

Trezor wins on transparency, and Ledger's own record includes the 2020 e-commerce database breach and the 2023 Recover backlash. But Ledger's architecture runs cryptographic operations inside its certified secure element, so on the specific axis the Donjon attack exposed, Ledger's design is the more resistant of the two. Buyers should weigh open, auditable firmware against in-SE signing and decide which risk model fits them. Neither vendor gets a clean sweep.

Native support covers Bitcoin, Ethereum, Solana, Cardano, XRP, Litecoin, Dogecoin, Bitcoin Cash, Zcash, and Ethereum Classic, plus EVM networks including Polygon, BNB Smart Chain, Arbitrum, Base, and Optimism. Token standards span ERC-20, BEP-20, and SPL. Trezor markets “1000s of coins and tokens,” and the named-chain list above is the honest version of that claim. For a multi-chain holder with mainstream assets, coverage is complete. Users deep in newer ecosystems should check the Trezor supported-assets list before buying.

Setup runs through Trezor Suite, which sets the bar for polish in this category on desktop. Windows, macOS, and Linux get the full experience, Android gets full functionality over USB-C, and iOS is the weak spot: the iPhone app can track balances, buy, and receive, but cannot send. A web version runs in Chromium browsers only.

The hardware itself is deliberately minimal. A small monochrome screen and two physical buttons handle everything, including PIN entry and address verification. It works, and address checking on-device is the point of a hardware wallet, but scrolling a long address two characters at a time is the price of the $59 tag.

Recovery options run deeper than the price suggests. Standard 12, 20, or 24-word BIP39 backups are joined by SLIP39 multi-share backup, which splits recovery across multiple shares so no single piece of paper is a single point of failure. The optional passphrase adds a hidden-wallet layer on top of the seed, and after the Donjon disclosure it should be treated as part of the standard setup, not an advanced extra. Sixteen wrong PIN attempts wipe the device.

Trezor Suite includes partner-powered buy and sell, staking for ETH, ADA, and SOL, and swaps through integrated partners plus DEX access via WalletConnect. Staking is delegated through the Suite interface while keys stay on the device, so self-custody is preserved. Buying and selling through fiat partners can require KYC depending on the provider and amount. DEX swaps require none. None of these features are unique to Trezor, but none of them compromise the custody model, which is the standard that counts.

The device is $59, down from its $79 launch price, and that is the entire cost of ownership. There is no subscription and no charge for Trezor Suite. Swap and on-ramp partners take their own fees and spreads per transaction, disclosed at quote time, and they are the same class of third-party cost every hardware wallet passes through. At $59, the Safe 3 undercuts the Ledger Nano S Plus ($79) while matching its EAL6+ secure-element certification, and nothing else from a first-tier vendor touches its price.