Trezor

SatoshiLabs shipped the first Trezor in 2014 and basically invented the consumer hardware-wallet category. The idea has not changed: private keys never sit in a browser or phone OS. The device signs. You verify address and amount on its display. PIN locks the unit. Optional passphrase creates a “hidden” wallet that only exists if you remember the extra word. That is still the correct mental model for serious self-custody.

2026 buying map is the Safe series. Older Model One and Model T still work for many people but are legacy / end-of-life for new purchases.

- Safe 3: cheapest Secure Element Trezor. Monochrome screen, two buttons, USB-C, EAL6+ SE. Best pure value for cold storage.

- Safe 5: color touchscreen + haptics, stronger MCU story (STM32U5 vs older glitch concerns on Safe 3), same Suite features. Default pick for most users who want readable confirmations.

- Safe 7: premium flagship. Larger touchscreen, Bluetooth for mobile-friendly signing, multi-chip security story including TROPIC01 (marketed as a more transparent / auditable Secure Element) plus OPTIGA and modern MCU. Quantum-ready messaging sits in the branding. Buy this if you want the newest stack and phone convenience.

Bitcoin-only firmware editions exist for Safe devices if you want a smaller attack surface and zero altcoin UI. Multi-coin firmware covers thousands of assets through Suite; some chains (Solana-heavy stacks, certain newer L1s) still push people to Ledger or a software wallet with Trezor as a signer where supported. Check the live coin list before you assume every bag fits.

Trezor Suite (desktop is primary; mobile exists with limits, historically weaker on iOS signing) is the companion app. Send, receive, swap via partners, stake selected assets, connect to some dApps, run Tor, and for Bitcoin run CoinJoin through Wasabi-backed infrastructure inside Suite. No Ledger Recover equivalent: there is no KYC subscription that reassembles your seed from custodians. That is a feature for cypherpunks and a liability for people who lose backups. Recovery options are standard seeds plus SLIP-39 Shamir (multi-share): split the backup so you need M-of-N shares, not one scrap of paper. MicroSD on some models helps with encrypted PIN / offline update workflows. Buy only from trezor.io or authorized sellers. Initialize yourself. Never type a seed into a website.

Open source is the brand wedge. Firmware, Suite, and a lot of the stack sit on GitHub for review. Safe-series Secure Elements are NDA-free EAL6+ parts Trezor can talk about more openly than Ledger’s closed SE OS. Honest nuance: the SE still holds secrets you cannot fully “read” like application code, and some signing still involves the general MCU. You are trusting a transparent development culture plus certified silicon, not magic. Physical attack research (including past Kraken / Donjon-style work) has shaped firmware fixes over the years. That loop is why open source matters.

Trust scars that still matter: marketing-list / Mailchimp-era breaches fed phishing that still hits Trezor owners. Scammers spoof support and ask for seeds. The device cannot save you if you enter the recovery phrase into a fake “sync” page. Same rule as Ledger: Trezor never needs your seed online.

Versus Ledger: pick Trezor for auditable firmware culture, Shamir backups, CoinJoin/Tor privacy tooling, and no Recover-style seed escrow. Pick Ledger for broader altcoin / Solana app polish, Clear Signing marketing, and a denser mobile/dApp retail ecosystem (especially pre–Safe 7). Versus software wallets alone: Trezor is for money you cannot afford to lose to a browser drainer. Versus exchanges: you own keys and own backup failure.

Costs: device price is the product (roughly Safe 3 entry through Safe 7 premium). Suite has no subscription. You pay network fees and any swap / fiat partner spreads. No Multisig service-fee drama like Ledger’s late-2025 Enterprise Multisig pricing fight; advanced multisig usually means external coordinators (Sparrow, etc.) with the Trezor as a signer.

Who it’s for: Bitcoin and major-asset holders who want verifiable self-custody, people who care about open firmware and Shamir backups, and anyone allergic to KYC seed recovery. Who should look elsewhere: heavy Solana / long-tail DeFi users who need Ledger’s app coverage, buyers who want seed recovery via ID, and users who will not verify every address on-device.

STRENGTHS

- Category pioneer with a decade-plus track record and open-source firmware you can actually inspect

- Safe series adds EAL6+ Secure Element while keeping the transparent software culture

- Shamir (SLIP-39) multi-share backup reduces single-paper total-loss risk

- Passphrase / hidden wallets and Bitcoin-only firmware for tighter threat models

- CoinJoin + Tor in Suite for Bitcoin privacy without bolting on random apps

- No KYC seed-recovery product. Pure self-custody if that is your requirement

- Clear model ladder: Safe 3 value, Safe 5 daily driver, Safe 7 premium / Bluetooth mobile

WEAKNESSES

- Altcoin and Solana convenience still trails Ledger for many active DeFi users

- Mobile experience historically USB-first; iOS signing limits frustrated phone-only users (Safe 7 Bluetooth helps, does not erase the past)

- Not QR air-gapped. USB (and Bluetooth on Safe 7) means a connected host is still in the loop

- Secure Element + MCU split is more nuanced than marketing one-liners. Read the architecture if you are paranoid

- Older Model One / Model T lack modern SE; new buyers should stick to Safe series

- Phishing after customer-data leaks remains a major loss vector unrelated to chip strength

- Suite partner swaps and limited native NFT / long-tail staking mean power users still leave Suite often

- Upfront hardware cost and a learning curve around passphrase / Shamir if you use the advanced tools wrong